Security controls built in and mapped to SOC 2 and ISO 27001
The platform implements per-tenant data isolation, append-only audit, RS256 token verification, Secure SameSite=Lax cookies, short token lifetimes, refresh rotation, fail-closed secret handling and GDPR lifecycle controls. The platform is audit-ready for SOC 2 and ISO 27001, with controls mapped to the implementation.
Compliance status
Audit-ready for SOC 2 and ISO 27001: the Trust Services Criteria and Annex A controls are built into the platform, with the evidence an auditor asks for. GDPR controls are built in: self-service export of everything held about a person, erasure across the platform services and every installed app that declares it, personal-data redaction in audit records, and recorded acceptance of each Terms of Service version. OWASP ASVS Level 2 is tracked internally as a controls backlog. See the current status on the Trust page.
What ships with the platform
Secure; SameSite=Lax token cookies
Access tokens last 15 minutes for portal and console sign-in, and up to 60 minutes for connected AI apps such as Claude or ChatGPT. Browser tokens sit in Secure cookies, and refresh tokens are single-use with reuse detection.
RS256 token verification
Platform services verify token signatures against published signing keys and reject revoked token identifiers.
Append-only audit chain
SHA-256 hash chaining means altering a stored event is detectable.
Tenant isolation
Customer data in Authorization, Audit, Comments, Support, AI and sign-in accounts is kept in a separate database for each organization. Data and Automation use a separate database for each app instance. Notification delivery is planned to follow. Shared services enforce organization and app-instance scope on customer queries. Dedicated databases, cache and event streams are available for supported components.
Encryption at rest + in transit
Database and object storage are encrypted at rest, and traffic to the platform uses TLS. Cache and event-stream storage use platform-managed keys.
Bring your own encryption keys
For dedicated deployments: your database storage, its credentials and your object storage encrypted with a key you hold in your own cloud account, so withdrawing our access makes the data unreadable, including to us.
Secrets fail closed
Required keys are validated at startup — no silent defaults. A service refuses to boot with a missing secret rather than falling back to an insecure default.
Export and identity standards
Tenant data is stored in standard databases and exported in documented formats. Identity integrations use OIDC, OAuth, SAML, LDAP and SCIM, reducing the work required to change providers or deployments.
Backups and recovery targets
Daily automated database backups with point-in-time recovery. Customers on eligible plans create, schedule and restore backups from the portal. Recovery targets are design intent: critical services within one hour with at most five minutes of data loss, other services within four hours with at most one hour.
Incident response plan
A written incident response plan is in force: authority notice within 72 hours where GDPR requires it, named roles, and a postmortem within five business days.
Every release is checked before it reaches production
The platform checks the software artifact before it reaches production, records where it came from and keeps the rollout reversible. That turns release integrity into a platform control instead of another process your product team has to build and maintain.
Only verified software is admitted
Production images are tested, vulnerability-scanned, signed and pinned to an immutable digest. The deployment pipeline blocks an image when its identity or required evidence cannot be verified.
Every release leaves evidence
A software bill of materials, build provenance and signing record connect the reviewed source to the exact artifact deployed. Security and procurement teams can verify what is running without relying on a mutable image tag.
Rollouts contain failure
Deployment health checks keep failed revisions out of service and support rollback to the last healthy release. Infrastructure changes are previewed before application so replacements and destructive changes can be reviewed explicitly.
Review the security controls and architecture
The security whitepaper is available on request. Under a mutual NDA we share the deployment assessment, the completed security questionnaire and the architecture detail behind it.