Security
Boring infrastructure. On purpose.
What we run, how we run it, and the receipts to back it up.
Data minimisation
We store the data you give us, scoped to the request. We don't ingest your customer data unless explicitly contracted to.
Access control
Production systems use SSO + MFA + IP allow-listing. No shared credentials. Hardware security keys for staff.
Encryption
TLS 1.3 in transit. AES-256 at rest. Per-tenant keys for client data; rotated quarterly.
Auditability
All admin actions logged with actor, timestamp, and target. Logs retained 13 months in immutable storage.
Incident response
On-call 24/7 with 30-minute response on P1. Customer comms inside 2 hours. Postmortem published inside 7 days.
Compliance
SOC 2 Type II in progress (target Q4 2026). HIPAA-ready architectures available for health clients. GDPR-aligned by default.