Who signs in / IT and security
For the person who has to sign off on this
Isolation, encryption, identity, audit, recovery and change management — described mechanically, including where the position is weaker than we would like.
You are the reader most vendor sites are not written for. This page assumes you will ask how, not whether.
The question this answers
What would make you reject this platform?
A fair question to ask us, so here are the honest answers: a region switch is a checklist a person runs rather than an automatic cutover, our 99.9% uptime figure is a target rather than a contractual SLA, our certification position is something to ask us about directly rather than infer, and we are a small team. If any of those is disqualifying, that is a legitimate reason to stop — and better established now than in month six.
The controls, in the order you will ask
Mechanism, not posture
Isolation
Organization resolved from the session; a read filter clamps every query; row-level security forced on every tenant table, with an organization wall and a client wall.
Data Protection
All of your data under your own key in your own cloud account; withdraw it from your console and access closes within 60 minutes. Identity numbers in a separate vault; credentials never shown again.
Identity and Access
Authenticator codes required for administrators and adjusters with no setting to weaken them, OpenID Connect or SAML sign-in, SCIM provisioning, and entitlement then role, both default-deny.
Audit
Add-only audit rows naming who, when, the record and every changed field, with personal details sealed inside. Waypoint’s break-glass access reaches servers only, never your data: two-person approval, automatic expiry, every use logged.
Recovery
Hourly encrypted backups, write-locked for 30 days, copied to an isolated account in a second US region, with a standby region and a weekly restore test.
Change Management
The full test suite gating every restart, structure changes under a separate deploy account, and vocabulary checks that fail the build on domain confusion.
Testable claims
What you can verify with our engineers present
Every line here is checkable in a technical session rather than accepted on assertion. Ask to see the policies, not the paragraph about them.
Row-level Security Is Forced
Inspect the policies and the force setting on tenant tables
No Tenant Parameter Is Accepted
Attempt to specify another organization on a request
Your Key Can Be Revoked
Connect a key, then disable it in your own console and watch the nightly check fail
The Code Step Cannot Be Skipped
Try any page request without passing the authenticator step
Audit Rows Cannot Be Deleted
Clear the view, reload, and find every entry still there
The Pipeline Gates
Ask what happens to a deployment with a failing test
Where we are honest
The four honest answers
Listed together so you do not have to hunt for them across the site.
A Person Switches Regions
The standby region replicates continuously, but the switch is run by a person on an alarm, by checklist. Users sign in again afterwards.
A Target, Not An SLA
99.9% uptime is a target measured every minute by an outside monitor, not a contractual commitment.
Ask About Certification
Ask directly about our current certification position rather than inferring one from these pages.
Small On-call Team
We are early-stage. Response depth is not that of a vendor with a follow-the-sun operations center.
Read next
Send the long questionnaire
In your own format. We will complete it and flag every answer where our position is weaker than the question hopes for, which is the fastest way for you to decide.