Security

What we actually do, described precisely enough that your security reviewer can check it.

Tenant isolation is enforced by the database

Every row of customer data is protected by two boundaries: an account boundary and an organisation-membership boundary within it. Both are enforced by PostgreSQL row-level security, not by application code — so a bug in a screen cannot return another customer's data, because the database never sends it.

Isolation is proved by an automated test suite that runs on every change and blocks release on failure.

Staff access is a session, not a standing privilege

Our own staff hold no membership in your account. They cannot browse customer data. Support access is opened deliberately for one customer, with a written reason and an expiry, and every read under it is recorded against that session in an audit log staff cannot alter.

Actions that undo a customer decision — such as cancelling a scheduled deletion — require a second staff member to approve, and the person who requested it cannot be that approver.

The audit trail cannot be rewritten

Operational changes are written to an append-only log. Update, delete and truncate are revoked from every application role, including the service role — records are inserted by database triggers and never edited afterwards.

Deletion means deletion

Ordinary deletes are reversible: rows are archived, not destroyed. If you want your data genuinely erased you can schedule permanent deletion yourself; it runs after a 30-day grace window during which you can cancel, and it removes files, accounts and history rather than hiding them.

Encryption

Encrypted in transit with TLS, and at rest at the database and object-storage layer.

Certifications

We are not currently certified to ISO 27001 or SOC 2, and no audit is under way. We would rather say that plainly than imply an engagement that does not exist.

The controls those frameworks ask for were built in from the start — tenant isolation, append-only audit, least-privilege keys, encryption, monitoring, retention limits and reviewable staff access. Certification is planned once there is an operating history worth auditing. If a procurement process needs detail before then, ask us and we will walk through the controls with you.

Where your data is

Data residency and the full list of services that process your data are in the sub-processor register. If in-region processing is a requirement for you, raise it with us before you sign — it is a question we would rather answer early.