Who we help / IT and security
For the person who has to sign off on this
Isolation, encryption, access control, audit, recovery and change management — described mechanically, including where the position is weaker than we would like.
You are the reader most vendor sites are not written for. This page assumes you will ask how, not whether.
Send us your questionnaireWhat would make you reject this platform?
A fair question to ask us, so here are the honest answers: no automated failover, single region today, no published availability SLA, and a small on-call team. If any of those is disqualifying for your risk appetite, that is a legitimate reason to stop — and better established now than in month six.
Mechanism, not posture
The controls, in the order you will ask
- 01
Isolation
Organization resolved from the session and never accepted from a client; application scoping plus PostgreSQL row-level security enabled and FORCEd on tenant tables for every connection, owners included.
- 02
Data protection
Field-level encryption with a keyed blind index for search, masking by role, write-only integration credentials, and log redaction at write time.
- 03
Identity and access
Entitlement then role, both default-deny, enforced server-side per request. Forced reset on first sign-in, TOTP, SSO federation, and session denylisting on revocation.
- 04
Audit
A single controlled path for every status change, writing actor, timestamp, entity, action and reason — plus auditing of sensitive reads.
- 05
Change management
the full suite gating the restart, 245 ordered reversible migrations, and vocabulary checks that fail the build on domain confusion.
- 06
Operations
Encrypted backups, scripted restores verified weekly with a human decryption check, and dead-man alarms on the absence of scheduled jobs.
Testable claims
What you can verify with our engineers present
Every line here is checkable in a technical session rather than accepted on assertion. Ask to see the policies, not the paragraph about them.
RLS is forced
Inspect the policies and the FORCE setting on tenant tables
No tenant parameter is accepted
Attempt to specify another organization on a request
Credentials are unreadable
Save an integration credential, then try to read it back
Revocation is immediate
Revoke a session or key and reuse the token
Reads are audited
View a sensitive record, then query the audit log
The pipeline gates
Ask what happens to a deployment with a failing test
The four disqualifiers
Listed together so you do not have to hunt for them across the site.
No automated failover
Recovery is a scripted restore with a measured recovery time. Ask for the current figure from last week’s verified drill.
Single region
A regional infrastructure failure is a restore event, not a transparent redirect.
No published SLA or attestation
Insufficient operating history to defend an availability figure. Ask directly about our current certification position rather than inferring one.
Small on-call team
We are early-stage. Response depth is not that of a vendor with a follow-the-sun operations center.