Infrastructure & Security
Enterprise-grade security, built in
The Compliance Engine and your industry pack cover the regulatory controls. This page covers how the platform itself is built, hosted and protected underneath them.
Cloud or on-premisesPer-tenant encryptionMFA and role-based accessIndependently penetration tested
Deployment and isolation
Choose the environment that fits your security and regulatory requirements.
- Run as a shared multi-tenant service on your preferred cloud provider and region
- Choose dedicated infrastructure with its own database, application layer, storage and network
- Tailor the platform for an on-premises deployment when policy requires it
- Tenant data, cache and storage remain logically isolated in every deployment model
Protection and access
Layered controls protect the platform before and after login.
- DDoS protection and a web application firewall filter traffic before it reaches the application
- AES-256 encryption protects tenant data, files, exports and backups at rest
- Each tenant has its own encryption key; customer-managed keys are available for dedicated deployments
- MFA, role-based access, session expiry and optional IP or region allowlisting protect every account
Records, signatures and recovery
The evidence remains verifiable, recoverable and complete.
- Old value, new value, author, time and reason captured on every change
- Audit entries are append-only and hash-chained, so missing or altered history is visible
- Electronic signatures carry an independently verifiable RFC 3161 timestamp
- Encrypted continuous backups and daily snapshots support point-in-time recovery
Assurance and operations
Independent testing and continuous monitoring back the controls.
- Application, API and infrastructure layers are periodically tested by an independent security firm
- Critical and high findings block the next release until resolved
- DevOps monitoring watches continuously for anomalies against the 99% uptime target
- Private AI workloads stay inside your deployment and never train a shared model
Looking for the regulatory mapping? This page covers how the platform is built. For the controls that satisfy your industry's standards, see your industry page.
Have a security questionnaire to walk through?
Tell us what your customers or auditors need and we'll work through it with you.