Free trial

Security

What we ask of our suppliers, applied to us

This page is written so a procurement department can use it as it stands. If something you need for a questionnaire is missing, ask and we will send it.

Architecture

How it is built

  • Data residency by contract

    Processing and storage happen in the region the DPA states, with the specific provider named. The sub-processor list is short and is handed over with the agreement.

  • Tenant isolation

    Schema-level separation in Postgres with Row-Level Security. The boundary between clients is enforced in the data layer, not the application layer.

  • Encryption in transit and at rest

    Modern TLS on every connection and encryption at rest with keys segregated per tenant.

  • Access control

    Role-based permissions, least privilege, and SSO/SAML with your identity provider on the plans that include it.

  • Activity log

    Every material action is recorded with actor, object and timestamp. The client can query that log themselves.

  • Secure development

    Code review, static and dependency analysis in the pipeline, and security testing before every material release.

Certifications

Where we stand, honestly

We would rather tell the truth about our certification status than hang up a badge we have not earned yet.

  • ISO/IEC 27001

    Management system in place; certification process under way.

    In progress

  • SOC 2 Type II

    In preparation. No attestation issued as of today.

    In progress

  • GDPR compliance

    DPA available. Record of processing activities and, where required, impact assessment in preparation.

    In progress

  • Frameworks supported in the product

    NIS2, DORA, ENS, ISO 27001, NIST CSF, CIS, SOC 2, PCI DSS and more, as assessment frameworks for your own controls.

    In place

Responsible disclosure

Found something?

If you believe you have found a vulnerability in our systems, write to us before going public. We reply within 72 working hours and we take no legal action against anyone researching in good faith within the published scope.

Email security See security.txt

info@violetsecurity.io

Documentation for procurement

DPA, sub-processor list, architecture summary and a completed security questionnaire. Handed over on request; the architecture summary goes out under NDA.

Request documentation