Security Policy
Security is at the core of everything we do. Learn about our comprehensive security practices and how we protect your data.
SOC 2 Type II
Certified
ISO 27001
Compliant
GDPR
Compliant
99.9%
Uptime SLA
Our Security Commitment
As a security company, we hold ourselves to the highest standards. We practice what we preach by implementing comprehensive security controls across our infrastructure, applications, and operations. Our security program is regularly audited by independent third parties to ensure we meet and exceed industry standards.
Infrastructure Security
Cloud Infrastructure
- Hosted on AWS and Azure with SOC 2 compliance
- Multi-region deployment for redundancy
- Virtual Private Cloud (VPC) isolation
- DDoS protection and WAF
Data Centers
- Tier III+ certified facilities
- 24/7 physical security and monitoring
- Biometric access controls
- Environmental controls (fire, flood, power)
Network Security
- Network segmentation and micro-segmentation
- Intrusion Detection and Prevention Systems (IDS/IPS)
- Regular vulnerability scanning and penetration testing
- Centralized logging and SIEM monitoring
- Strict firewall rules with default-deny policies
Data Security
Encryption
| Data State | Encryption | Standard |
|---|---|---|
| In Transit | TLS 1.3 | All API and web traffic |
| At Rest | AES-256 | Database and file storage |
| Backups | AES-256 | Encrypted and geo-distributed |
| Secrets | HSM-backed | AWS KMS / Azure Key Vault |
Data Handling
- Tenant data isolation through row-level security
- Minimal data retention - only what's necessary for service
- Secure data deletion with cryptographic verification
- No code storage beyond scan result generation
- Customer-controlled data export and deletion
Application Security
Secure Development
- Secure Software Development Lifecycle (SSDLC)
- Mandatory code reviews for all changes
- Automated security testing in CI/CD pipeline
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Software Composition Analysis (SCA) for dependencies
- Regular third-party penetration testing
Authentication and Authorization
Authentication
- OAuth 2.0 / OIDC integration
- Multi-factor authentication (MFA)
- SSO support (SAML, OIDC)
- Secure password hashing (bcrypt)
- Account lockout protection
Authorization
- Role-Based Access Control (RBAC)
- Least privilege principle
- Fine-grained permissions
- Audit logging for all actions
- Session management and timeout
API Security
- JWT-based authentication with short expiry
- Rate limiting and throttling
- Input validation and sanitization
- CORS and CSP policies
- API versioning and deprecation policies
Operational Security
Monitoring and Response
- 24/7 Security Operations Center (SOC)
- Real-time threat detection and alerting
- Incident response plan with defined SLAs
- Regular tabletop exercises and drills
- Post-incident reviews and remediation
Business Continuity
- Disaster recovery plan with less than 4 hour RTO
- Daily encrypted backups with 30-day retention
- Geographic redundancy across multiple regions
- Regular backup testing and restoration drills
Change Management
- Formal change request and approval process
- Staged rollouts with canary deployments
- Automated rollback capabilities
- Change documentation and audit trail
Personnel Security
- Background checks for all employees
- Security awareness training (quarterly)
- Phishing simulation exercises
- Secure remote work policies
- Endpoint protection on all devices
- Principle of least privilege for system access
- Immediate access revocation upon termination
Compliance and Certifications
SOC 2 Type II
Annual audit covering security, availability, and confidentiality. Reports available upon request under NDA.
ISO 27001
Information Security Management System certification demonstrating comprehensive security controls.
GDPR
Full compliance with EU General Data Protection Regulation including data subject rights and cross-border transfers.
CCPA
Compliance with California Consumer Privacy Act requirements for California residents.
For Enterprise customers, we provide additional compliance documentation and can support custom security requirements. Contact us for security questionnaires and audit reports.
Vulnerability Disclosure
Responsible Disclosure Program
We welcome security researchers to help us identify vulnerabilities. If you discover a security issue, please report it responsibly.
Reporting Guidelines:
- Report vulnerabilities to [email protected]
- Include detailed steps to reproduce the issue
- Allow reasonable time for us to address the issue before disclosure
- Do not access or modify other users' data
- Do not perform denial of service attacks
Our Commitment:
- Acknowledge receipt within 24 hours
- Provide regular updates on remediation progress
- Credit researchers (with permission) in our security advisories
- No legal action against good-faith security researchers
Security Incident Response
In the event of a security incident affecting your data, we commit to:
- Notify affected customers within 72 hours of confirmed breach
- Provide detailed information about the nature and scope of the incident
- Describe the actions taken to contain and remediate the issue
- Offer guidance on steps customers should take
- Conduct a thorough post-incident review
- Implement improvements to prevent recurrence
Security Contact
Security Team
For security inquiries, vulnerability reports, or compliance requests:
[email protected]