Encryption in transit
TLS 1.2+ on every endpoint, HSTS enforced, no plain-HTTP listeners.
Security
Your records, protected by default.
The controls below describe how the product handles data in transit, at rest, and in the hands of your team. Statuses marked as examples are template placeholders — replace them with your current posture before launch.
Controls
The six controls everything else rests on.
Encryption at rest
AES-256 on the database, file storage, and backups.
Backups
Point-in-time recovery with daily full backups retained per your data-retention setting.
Monitoring
Anomaly alerts on authentication, exports, and connector errors, on call 24/7.
Least privilege
Staff access through SSO with role-based grants and quarterly reviews.
Isolation
Tenant data isolated at the schema level; no shared service accounts.
Access
Access follows roles, not memory.
Provisioning runs through your identity provider and mirrors your org chart. When someone leaves, SCIM removes access the same day — not the next review.
- SSO via SAML or OIDC, enforced per workspace
- SCIM provisioning so leavers lose access the day they leave
- Granular roles: preparer, approver, auditor, admin
- Read-only auditor seats with scoped period access
Compliance
Status, stated plainly.
Statuses below are example content marked with data-demo. Replace them with your product's current status before going live.
- SOC 2 Type II Example status — replace
- ISO 27001 Example status — replace
- GDPR DPA and subprocessor list on request
- Data residency EU or US region per workspace