Security & Compliance

Your policies contain sensitive information. Here's how we keep them secure.

Last updated: 17 February 2026

Security Architecture

  • OWASP Compliant: Documented 95/100 security score with complete OWASP Top 10 protections
  • Multi-Tenant Isolation: Organization-level data isolation with row-level security
  • ISO 27001 Aligned: Implements 12+ Annex A controls including access control, cryptography, and secure development
  • SOC 2 Ready: Comprehensive audit logging, security monitoring, and access controls

Data Protection & Privacy

  • GDPR Compliance: Full implementation of Articles 15 (Right to Access) and 17 (Right to Erasure)
  • Data Subject Rights: Automated data export in JSON/CSV/PDF formats with 7-day expiration
  • Consent Management: Cookie consent tracking and preference management (Article 7)
  • Data Residency: European data hosting (Frankfurt, Germany) on Render infrastructure
  • Retention Policies: Automated data cleanup with 30-day grace period for deletions

Encryption & Cryptography

  • In Transit: TLS 1.2+ encryption with HSTS preload for all communications
  • At Rest: AES-256-GCM encryption for sensitive data (API keys, credentials, TOTP secrets)
  • Password Security: Bcrypt hashing with 14 salt rounds
  • Key Management: 256-bit encryption keys with runtime validation
  • Database: Managed PostgreSQL with encrypted backups

Authentication & Access Control

  • Multi-Factor Authentication: TOTP-based 2FA with backup codes (bcrypt hashed)
  • Password Policy: 12+ characters, complexity requirements, 90-day rotation, history of last 5
  • Account Lockout: 5 failed attempts trigger 30-minute lockout
  • Role-Based Access Control: Granular permissions with resource and action-based controls
  • Session Management: JWT rotation, device tracking, 5 concurrent sessions max per user
  • Anomaly Detection: New IP and device detection with email alerts

Security Monitoring & Logging

  • Comprehensive Audit Logging: Every user action logged with IP address and user agent
  • Security Event Tracking: Categorized events (INFO, WARNING, CRITICAL) with severity classification
  • Immutable Audit Trail: Complete history of authentication, policy changes, and data access
  • Real-Time Monitoring: Security event monitoring with automated alerting
  • Compliance Dashboard: Framework coverage, policy status, and approval metrics

Infrastructure Security

  • Hosting: Render.com (EU region) with automated scaling and failover
  • Database: Managed PostgreSQL with automated backups and point-in-time recovery
  • DDoS Protection: Advanced rate limiting with 7 different tiers (API, LLM, bulk ops, exports)
  • Firewall & WAF: Network-level protection with intrusion detection
  • Security Headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options

Application Security

  • SQL Injection Prevention: Parameterized queries and pattern-based detection
  • XSS Protection: Input sanitization, output encoding, and strict Content Security Policy
  • CSRF Protection: Double-submit cookie pattern with secure, httpOnly cookies
  • Command Injection Prevention: Shell metacharacter filtering and validation
  • Path Traversal Protection: Directory traversal pattern detection
  • Input Validation: Comprehensive validation against injection attacks

Data Isolation & Multi-Tenancy

  • Organization Boundaries: Strict org_id validation on all API endpoints
  • Row-Level Security: Database-level context isolation
  • No Cross-Organization Access: Cannot access data outside your organization
  • Audit Separation: Complete audit trails per organization

Compliance & Standards

  • ISO 27001 Controls: A.5.1 (Security Policies), A.8.3 (Access Restriction), A.9.2 (User Access), A.9.4 (System Access), A.12.4 (Logging), A.14.2 (Secure Development), A.18.1 (Cryptographic Controls)
  • GDPR Articles: Art. 5 (Principles), Art. 7 (Consent), Art. 15 (Access), Art. 17 (Erasure), Art. 25 (Privacy by Design), Art. 32 (Security of Processing)
  • SOC 2 Trust Criteria: Security, Availability, Confidentiality with comprehensive controls
  • OWASP Top 10: Complete protection against all 10 vulnerability categories

Our security practices comply with international standards including ISO 27001, SOC 2, and are aligned with regulatory requirements across UK (ICO), EU (GDPR), Switzerland (nDSG/FINMA), US (CCPA/HIPAA where applicable), and Asia-Pacific jurisdictions.

Incident Response

We maintain a comprehensive incident response plan:

  • Real-time security monitoring and alerting
  • Defined escalation procedures and response playbooks
  • Customer notification within 72 hours (GDPR requirement)
  • Post-incident reviews and continuous improvement
  • Security event correlation and forensic capabilities

Operational Security

  • Secure Development: Security-first development practices with code review
  • Dependency Management: Regular updates and vulnerability scanning
  • Configuration Management: Environment-specific configs with secrets management
  • Least Privilege: Minimal access rights for all system components

Questions or Security Reports?

For security inquiries or to report a vulnerability:

Email: security@policy-suite.com
Response Time: Within 48 hours for security reports
Security Documentation: Available on request for compliance reviews