Trust Centre

Version 1.1 · 26 October 2026

SecuraTrack is one platform for AI governance and compliance. Your team attests controls from a single library mapped across frameworks, and read-only connectors check them against what your systems actually report. This page summarises how we host, protect and operate it. The same content is available as a one-page PDF for a vendor file, on request.

• Hosted in your region
• MFA on every account
• Read-only connectors
• Row-level tenant isolation
• Hash-chained audit log
• AI optional, bring your own model

Hosting and architecture

• Your deployment runs in one region and your data stays in it. Switzerland and the European Union today, the United States from October 2026, and any AWS region a contract requires.
• Database, sign-in and evidence files: Supabase, managed Postgres on AWS, in that region. Application hosting sits in the same region.
• Connector workers run on a dedicated server, with their secrets in AWS KMS and never on disk.
• Multi-tenant by default. A dedicated single-tenant deployment is available on enterprise terms.

Data protection

• Every tenant table is isolated by Postgres row-level security, and the application's database role cannot bypass it.
• TLS 1.2 or better on every connection, HSTS on the web, TLS required to the database, AES-256 encryption at rest.
• Evidence downloads use signed links that expire after 60 seconds.
• Export to CSV and PDF at any time. Deleting your organisation deletes its records and its evidence files.

Identity and access

• Multi-factor authentication is required for every user and checked on every request, in the interface and in the API.
• Passwords of 12 characters or more, checked against known breaches. Access tokens expire hourly and refresh tokens rotate on use.
• Four roles enforced on the server: Admin, Manager, Member and Auditor, the last read-only. Only an Admin can grant Admin or reset another user's MFA.
• SAML single sign-on with Entra ID, Okta, Google Workspace or any SAML provider, enforceable per organisation. Our own production access is limited to two people, each with an individual account and MFA.

Connectors to your systems

• 23 connectors across identity, cloud, endpoint, source code, AI providers and business tools, each using read-only credentials.
• The exact permissions each connector needs are documented per connector and published, so you can review them before you connect anything.
• Connectors add evidence. They never change a control's status: only your people do, and the database enforces it.
• Credentials are encrypted with AES-256-GCM before storage. The web application can only encrypt them; the connector workers decrypt them in memory at poll time. Disconnecting a system deletes its credential.

AI and your data

• AI features are optional, and an Admin can switch them off for the whole organisation.
• Models run through OpenRouter, or bring your own: your key for any OpenAI-compatible endpoint, stored encrypted and never displayed again.
• Prompts carry only the control context a feature needs. Your company name and your people's identities are never sent, and an automated test enforces it.
• Routing is restricted to model providers that do not train on inputs.

Audit and monitoring

• Every change is recorded, with who, what and when, in an append-only audit log. If the audit write fails, the change is rolled back.
• Entries are hash-chained and the chain is re-verified every night. A break is recorded and raised to the operators.
• Every scheduled job writes a run record. Internal error details never reach the browser.
• Rate limits on API calls, and bot protection on public forms.

Secure development

• A release reaches production only after the full suite passes on that exact commit: type checks, unit and integration tests, and end-to-end browser tests with real MFA logins.
• A deploy is refused without a green receipt for that commit, or if the database is behind the code. Health is checked after release, with rollback.
• Static analysis and secret scanning on every change, and critical vulnerabilities fixed within 7 days and high within 30.
• Database changes are additive and reviewed before they reach production.

Resilience and incidents

• Daily database backups, kept 7 days. Restores are tested quarterly, and the last drill restored in under a minute.
• Recovery point 24 hours, recovery time 8 hours.
• If a confirmed incident affects your data we notify you within 48 hours, with what we know and a named contact.
• Uptime target 99.5%, stated as a target rather than a contractual SLA.

Subprocessors

We use a small set of providers to run SecuraTrack. Each processes data only as needed to provide its service to us.

Compliance and documents

• SOC 2 Type I is in preparation. We do not claim a report we do not hold.
• We run our own security programme inside SecuraTrack, against ISO 27001:2022.
• On request: the full technical brief, a completed security questionnaire in CAIQ or SIG Lite form, our data processing agreement, and this subprocessor list as a signed document.

Reporting a vulnerability

Our disclosure policy, including scope, what we commit to and safe harbour for good-faith research, is on the security page. Machine-readable contact details are at /.well-known/security.txt.