Security is a platform capability, not an Enterprise tier
RLS tenant isolation, encrypted storage, signed webhooks, and the DSR portal are built into the platform core. They are not add-ons unlocked at a higher price point. We publish our controls, incident history, and sub-processor list in full.
Annual third-party audit covering security, availability, and confidentiality trust service criteria. Report available under NDA to any plan — not just Enterprise.
Highest tier of PCI compliance for payment card data. Cardholder data never touches our servers — tokenized at the payment edge before any platform code runs.
Automated DSR portal for erasure and portability requests, with a sub-30-day SLA. Data Processing Agreement available on request for any tier.
Information security management system built to ISO 27001 controls. Formal certification in progress; interim controls are auditable on request.
Platform controls
Security controls built into the platform core — not layered on top.
Every table in the shared database carries Postgres Row-Level Security policies. A per-connection tenant GUC is set before any query runs — cross-tenant reads are architecturally impossible, not just a coding convention anyone can bypass.
Secrets live in three separate vault tiers: customer-visible config, internal service secrets, and root credentials. They never share an access path, rotation is automated, and every rotation is logged.
Scale and Enterprise plans support dedicated infrastructure in EU-West, US-East, or APAC. Data does not leave the chosen region except under explicit, auditable replication instructions you configure.
Every outgoing webhook carries an HMAC-signed payload and an idempotency key. Missed deliveries replay with exponential backoff. Stated target: 99.991% delivery rate. Your downstream handler can verify the signature and ignore safe duplicates.
Our on-call runbook requires a public status update within 5 minutes of a P0 declaration. Root-cause post-mortems are published within 5 business days — no private incident handling.
All storage layers are encrypted at rest with AES-256. TLS 1.3 is enforced in transit; older protocol versions are rejected. Database connections require SSL — no plaintext paths exist in the call graph.
Customers submit erasure, portability, or restriction requests through a self-serve portal. Erasure cascades across all tenant data, including backups, within 30 days — no manual ticket required.
Every admin action, data export, permission change, and API key issuance writes to an append-only audit log. Entries are hash-chained — tampering breaks the chain and raises an alert.
Sub-processors
We maintain a complete, versioned sub-processor list in our Trust Center. Every sub-processor is bound by GDPR Article 28-compliant DPA terms. Customers receive at least 30 days notice before a sub-processor is added or materially changed — with the right to object. Current categories: cloud infrastructure (Cloudflare, AWS, Neon, Supabase), payments (Stripe), transactional email (Resend), error monitoring (Sentry).
View full sub-processor list at trust.qosx3.com →