Built for sensitive compliance data.

EU data hosting

Customer data is stored and processed in European Union regions.

Hardened cloud infrastructure

Managed cloud services with restricted network access and least-privilege service accounts.

Independent infrastructure penetration test

Annual third-party testing programme.

Encryption in transit

TLS for all traffic between clients, services and storage.

Encryption at rest

Database and object storage encrypted at rest.

Customer-managed keys

Bring-your-own-key for encryption at rest.

Logical tenant isolation

Every record is scoped to a workspace and enforced server-side.

Separate vendor portal scope

Vendors only access the assessments and requests addressed to them.

Dedicated deployment

Isolated environment for large institutions.

Role-based access control

Admin, risk manager, analyst, auditor and read-only roles.

Multi-factor authentication

MFA available for all workspace users.

SSO / SAML

Federated sign-in with your identity provider.

SCIM provisioning

Automated user lifecycle management.

Audit logs

Who changed what, when, across providers, assessments, evidence, risks and the Register.

Field-level lineage

Regulatory values trace to their source record and evidence.

Audit log export

Scheduled export to your SIEM.

Automated backups

Regular encrypted backups of customer data.

Point-in-time recovery

Restore to a specific point within the retention window.

Documented restore testing

Periodic restore exercises with published results.

Deletion on request

An Organization Admin can export the whole workspace as JSON and permanently delete it — all records and all member accounts — from Settings › Data & retention.

Configurable retention policies

Set retention per object type.

Legal hold

Preserve records beyond standard retention.

No training on customer data

Documents and responses are processed to produce findings for your workspace only.

Workspace AI controls

An Organization Admin can switch model-assisted review off for the workspace; review then runs the rule-based pass only and no document or response text leaves the platform.

Human review required

AI never changes compliance status without an explicit human decision.

EU-region model processing

Model inference restricted to EU regions.

Documented incident process →

Severity classification, triage targets, containment, recovery, customer notification windows and post-incident review.

Status page

Public availability and incident communication.

Contractual notification commitments

Notification timelines agreed in the customer contract.

ISO 27001 certification

Not certified today. Preparation is on our roadmap and we will publish the certificate when achieved.

SOC 2 Type II

Not audited today. Planned once the ISMS programme is complete.

Security documentation pack

Architecture, sub-processors and DPA available on request.