Trust & security
Security is foundational, not a later feature
This product is a data processor: it holds your risk records, which can themselves contain personal data. The baseline below is built in from day one.
Data residency (EU)
The application and database are hosted in the EU, and your stored records stay in-region.
Encryption
All traffic is encrypted in transit with TLS. The database is encrypted at rest.
Tenant isolation
Every risk and record belongs to your organisation and is scoped to it at the data-access layer. There is no global data path.
Authentication & access
Sign-in is handled by a reputable managed authentication provider with multi-factor authentication available. Sessions are secure and expiring.
Secrets management
All secrets are injected from a secrets manager or environment at deploy time and are never committed to source control or shipped to the browser.
Sub-processors & your DPA
We use a small set of sub-processors to run the service, listed in full in our Privacy Notice. Our Data Processing Agreement is published and applies to every customer automatically, no signature needed.