Trust
Where the data lives, who can touch it, and which certifications we hold today. We would rather show you an empty box than a badge we have not earned, because you are going to check.
Certification status
Stated one line each, with no roadmap language standing in for a certificate.
Implementation underway. Not yet certified, and we will not display a mark we have not earned. We will publish the certificate number and issuing body on this page when it is issued.
Not held and not started. If you need SOC 2 today, we are not the right vendor yet, and we would rather say so than gesture at a roadmap.
Scheduled and budgeted, not yet performed. Until a practitioner has reviewed the calculation methodology, we call the output ready, not audited.
Not yet commissioned. The only security artefact we can point at today is a dependency allowlist with zero entries, which is a fact rather than a claim.
What is in force today.
Controls you can read, and in several cases check yourself from inside the product.
Stored and processed in eu-central-1. The sub-processor list is published, and it is short.
You see the request before deciding, you can refuse it, you can end a live session, and you can read every screen we looked at from your own audit trail.
Row-level security on every tenant table, fail-closed, and measured under simultaneous load rather than asserted.
GDPR erasure and Article 15 access requests are implemented and answered with a receipt naming what was retained and why.
On a paid plan, figures, lineage and the audit trail export as CSV and XLSX and your report PDFs are yours. The free tier keeps full lineage on screen but not the export.
Update permission on the report table is revoked at the database, and that revocation survived a full restore drill.
Data residency
Customer data is stored and processed in AWS eu-central-1 (Frankfurt). It is not replicated outside the European Union.
One thing we will not paper over: the controller and its operator are in India, and the service is administered remotely from there. Whether that remote administrative access constitutes a Chapter V transfer, and under which mechanism, is the single highest-value question in our counsel brief. It is open. When it is answered, this section will state the answer and the mechanism rather than the intention.
Isolation, measured
Row-level security is enforced on every tenant table, fail-closed, with 62 policies across 48 tables that are forced rather than merely enabled. That is the design. The measurement is more useful: under simultaneous two-tenant load across 27,768 requests, tenant A returned a p95 of 237.32 ms against tenant B’s 236.59 ms, 0.3% apart, with zero failures. A noisy-neighbour claim with a number behind it is a different kind of claim.
Support access is consented, refusable and logged
- You see the access request before deciding, with the reason the engineer gave.
- You can refuse. A refusal is recorded as an outcome, not dismissed as a dialog.
- You can end a live session yourself, without asking us.
- Every screen we opened is written to your own audit trail for you to read afterwards.
- Emergency access is its own permission, held by one role, and writes to the same chain.