Layered encryption, verified rather than assumed
Every layer below is independently testable. None of them, alone or combined, makes a system impossible to breach — and we won't tell you otherwise.
ENCRYPTION
Where encryption sits
Five layers, each with its own control and its own failure mode.
Perimeter & transport
TLS 1.3 · HSTS enforced · certificate transparency monitoring
Application
Field-level encryption for sensitive report data · strict input/output handling
Data at rest
AES-256-GCM · envelope encryption
Key management
Customer-managed keys · scheduled rotation · separation of duties
Hardware root of trust
HSM-backed signing, FIPS 140-2/3 validated modules
No layer here, alone or combined, makes a system impossible to breach. Defense in depth is designed to raise the cost of compromise and shorten the time to detect one — that is the honest claim we make.
OPTIONS
Enterprise security options
Configured per engagement, not bundled by default.
Customer-managed keys
Encrypt data at rest with keys you control.
Keys live in your own KMS. We reference key identifiers; we never hold a standing copy of your key material outside an authorized operation, and you can revoke access by rotating or disabling the key.
HSM-backed key custody
Signing keys never leave validated hardware.
Root and intermediate keys are generated and used inside FIPS 140-2/3 validated hardware security modules. Private key material is never exported in plaintext.
Private connectivity
Keep sensitive traffic off the public internet.
VPC peering, PrivateLink, or a dedicated tunnel between your environment and ours for engagement traffic that never needs to touch the open internet.
Dedicated tenancy
Isolated infrastructure, not a shared pool.
Compute, storage, and key material are provisioned per engagement rather than shared across clients on common infrastructure.
Identity federation
Your identity provider stays the source of truth.
SAML or OIDC single sign-on with SCIM provisioning, so access to reports and the command center follows your existing joiner-mover-leaver process.
Immutable audit logging
Access to findings is logged and cannot be edited after the fact.
Write-once audit trails covering who viewed or exported which artifact and when, exportable to your own SIEM.
Data residency controls
Choose where assessment data is processed and stored.
Regional processing options for organizations with data residency or sovereignty requirements.
Break-glass access review
Emergency access is possible, but never invisible.
Any emergency access path requires dual approval and generates an immediate, unsuppressable audit entry.
See request an assessment to scope which of these options apply to your engagement, or read the implementation status of the platform itself in SECURITY-NOTES.md.