Security
What is in place, and what is not.
A security vendor that is vague about its own posture has told you something. This page states the controls that exist today and, below them, the things that are not done yet.
If something here matters to your assessment and is not covered, ask. A question we cannot answer straight is worth knowing about before you buy, not after.
In place today
Controls you can verify during an evaluation.
Access
- Single sign-on
- SAML and OIDC, so your identity provider decides who gets in and when they stop getting in
- Multi-factor authentication
- Time-based codes or email, enforceable for every user in an organisation
- Role-based access control
- Permissions assigned by group at feature level, not one blanket admin role
- Session control
- Administrators can revoke active sessions immediately
Separation
- Per-organisation isolation
- Every record carries its owning organisation, and access is filtered on it
- Database-level policy
- Row-level security is configured on every tenant-scoped table as a second layer
- Service provider mode
- Multiple client environments kept separate under one operator account
Data
- Encryption in transit
- TLS on every connection, with modern ciphers only
- Credentials encrypted at rest
- Integration secrets are encrypted in storage, not stored as text
- Secret redaction
- Configured secrets are never returned in an API response, on read or on write
- Retention and erasure
- Scheduled purging, and removal of personal data on request
Accountability
- Audit log
- Security-relevant actions recorded with actor, time and target, exportable
- Change attribution
- Records show who changed what, including overrides of automated decisions
- Outbound control
- All traffic the platform initiates is validated and constrained before it leaves
Not done yet
The part most vendors leave out.
Everything below is a real gap. None of it is disqualifying on its own, and all of it is better heard from us than found by your assessor.
We are not certified
The platform maps its controls to recognised frameworks and can report coverage against them. That is not the same as holding a certification, and we will not imply that it is. If a certification is a procurement requirement today, we are not yet the right answer.
Database-level isolation is configured, not yet enforced
Row-level policy is in place on every tenant-scoped table as defence in depth, but the enforcement cutover has not been completed. Application-level separation is the control doing the work today. We would rather tell you which layer is load-bearing than let you assume it is both.
The platform is early
This is a product being evaluated by its first customers, not a decade-old deployment. That is worth knowing before you make it a dependency, and it is also why access to the people building it is unusually direct.
Reporting a vulnerability
Tell us before you tell anyone else.
If you find a security issue in this website or in the platform, we want to hear about it. We will not pursue legal action against anyone acting in good faith under this policy, and we will keep you updated on the fix rather than going quiet after the acknowledgement.
- Static public pages
- Every page you can reach without signing in is pre-rendered. No code runs to serve it and no user input is rendered into it.
- One small server surface
- The contact form writes to a request store, and an internal console reads it. That is the entire server-side footprint of this site, and it is separate from the platform.
- No third-party origins
- Fonts and assets are served from this domain. Nothing is loaded from anyone else.
- Strict content policy
- The page may load resources from this origin and nowhere else, and it cannot be embedded in a frame.
- Separate from the product
- This site shares no infrastructure, credentials or database with the platform. Enquiry data never touches customer data.
Send us your security questionnaire.
We will answer it directly rather than returning a brochure, and we will mark the questions where the honest answer is "not yet".