Certified by InterCert. Independent, accredited assessment of our Information Security Management System.
The Information Security Management System applies to our AI-powered cloud platform for CRM data integrity and management, with the support functions of IT, Human Resources, Administration and Legal.
Certified. Valid through April 30, 2029.
Compliant. EU data protection.
Compliant. California data rights.
In progress.
Encryption. TLS 1.3 in transit. AES-256 at rest. Keys managed via HashiCorp Vault. Annual key rotation.
Access Control. SSO required. MFA enforced on all critical systems. Role-based permissions. Least privilege enforced. Access revoked within 24 hours of departure.
Monitoring. 24/7 security monitoring. Real-time alerting. Comprehensive audit logging. Weekly log reviews.
Infrastructure. Multi-region cloud (DigitalOcean EU). Automatic failover. 99.99% uptime SLA.
Scanning. External scans quarterly. Internal dependency scans monthly.
Penetration testing. Annual third-party penetration testing.
Patching. Critical vulnerabilities patched within 1 business day. High within 3 days.
Secure SDLC. Security and privacy considered at every development phase.
Code review. All changes require pull request review before production.
OWASP aligned. Coding practices follow OWASP Secure Coding Guidelines.
Automated testing. Static analysis and dependency scanning in CI/CD.
Recovery objectives. RPO: Point-in-time. RTO: < 12 hours for core data.
Backups. Nightly full database backups + continuous write-ahead log archiving.
Redundancy. Multi-region backups. Automatic failover capabilities.
Testing. Annual BC/DR exercises. Quarterly backup restoration tests.
Primary processing. EU data centers (DigitalOcean EU).
International transfers. Standard Contractual Clauses (SCCs) for transfers outside EEA.
Sub-processors. Maintained list available on request.
Background checks. All personnel screened before access is granted.
Training. Annual security awareness training required.
Confidentiality. NDAs signed by all employees and contractors.
Access revocation. Logical access revoked within 24 hours of departure.
You own your data.
Detection: < 5 minutes
Containment: < 1 hour
Initial triage: < 4 hours
Notification: < 24 hours (< 72h per DPA)