Controls

Technical and organisational controls

How we keep the product safe, in five layers: infrastructure, organisation, product, AI safety, and data and privacy.

Infrastructure security

EEA-only hosting, documented per subprocessor
Encryption at rest (AES-256) and in transit (TLS 1.2+)
Multi-tenant isolation across customer environments

Organisational security

ISMS and PIMS (ISO 27001 + 27701)
Least-privilege access with onboarding and offboarding reviews
Incident response and vendor management with annual reassessment

Product security

Secure SDLC with code review, static analysis and dependency scanning
SSO and mandatory MFA for administrators
Audit log of administrative actions and data access

AI safety

Sensitive-data detection before transfer to external models
Consent flow for external AI models, implemented in the product
Use-case guardrails for prohibited practices (AI Act art. 5)

Data and privacy

Records of processing activities (GDPR art. 30)
Defined retention periods and data deletion procedure
Breach notification within 56 hours to the customer