Technology · Security
Controls, not badges.
This page lists what is implemented. It does not claim certifications we do not hold. If you need documentary evidence for a specific control, ask and we will provide what exists.
- What it is
- A plain-language description of implemented controls: encryption, authentication, access control, session management, logging, monitoring, backups and recovery.
- Who it is for
- Security teams, compliance functions and anyone performing vendor due diligence.
- Why it matters
- Security pages that lead with logos rather than controls are not useful to the people who have to sign off.
- How it connects
- Access control is enforced in one place and applied across every module, including the API.
- What happens next
- Send your due-diligence questionnaire. We answer what we can evidence and say so where we cannot.
Specification
Where the boundaries are enforced.
Isolation and retention are the two questions a due-diligence pack asks in different words on every page. Both are answered below the application, which is the only place an answer holds.
Data at rest and in flight
- AES-256 at rest, TLS 1.3 in transit
- Row-level security in the database, so a tenant boundary is not an application concern
- Secrets held outside the application image
The record
- An append-only audit log: entries are added, never edited
- Seven-year retention, which is the horizon a regulator asks about
- Administrative actions recorded with the person, the time and the before-and-after
What is inside
Encryption
Data encrypted in transit with modern TLS, and at rest in the data layer.
Authentication
Multi-factor authentication available on client and staff accounts.
Access control
Role-based permissions, least privilege by default, enforced server-side.
Session and device management
Active session visibility, device records and remote revocation.
Audit logging
Security-relevant and administrative actions recorded with actor, time and change.
Secrets management
Credentials and keys held in a managed secret store, not in configuration files.
Monitoring
Application, infrastructure and session-health monitoring with alerting.
Backups
Regular, tested backups of the data layer with defined retention.
Disaster recovery
Documented recovery objectives and a business-continuity plan that is exercised.
Send the questionnaire
We would rather answer a hard due-diligence questionnaire accurately than publish a page of badges. Send yours.