Security
Security is part of every release
A short, honest summary for your IT and security team. Ask us for the full security document and a data processing agreement.
Isolation
One customer, one stack: own network, own encrypted Postgres database, own refresh job, own application, own secrets. No shared databases. Isolation is tested on every release.
Identity
Microsoft Entra ID single sign on for everyone, using OpenID Connect with PKCE against your tenant. Roles come from Entra app roles assigned to your groups. Sessions are server side in secure, httpOnly cookies. Tokens are never stored in the browser.
Access control
Every API route declares the permission it needs and defaults to deny. Report access is by group. Row level access is enforced by database policies, not by the front end and not by the AI. Sensitive columns are tagged and hidden unless allowed.
The AI's reach
The agent uses a read only database role with row and time limits, can only write proposals marked pending, and cannot publish. Only your specialist can approve a definition or publish a report. End users cannot prompt the agent.
Encryption and secrets
Encrypted at rest and in transit. Source credentials are write only: encrypted on entry and readable only by the refresh service. Secrets live in AWS Secrets Manager, never in code or the browser.
Audit and operations
Every agent call, specification change, publish, export and subscription is logged. Backups with point in time recovery. Sync failures and anomalies alert your IT contact. Support access to your stack is logged and time limited.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting of your dedicated stack (not used when deployed into your own AWS account) | London (eu-west-2) |
| Anthropic | Claude models for the report agent, under commercial terms with no training on customer data and no retention beyond the request | United States, with regional processing where available |
Your Microsoft Entra ID tenant and Azure Data Lake remain yours and are not sub-processors. We will tell you before adding any provider to this list.
Send us your security questionnaire
We answer them in full. Most take us a day.