Built so a breach of one workspace cannot touch another
Isolation is enforced by the database, not by application code that has to remember. Here is exactly how, and what we have not certified yet.
How isolation actually works
Enforced by foreign keys, not by remembering a WHERE clause
Every table carries a tenant identifier, and every foreign key is composite — it includes that identifier. A row in one workspace cannot reference a row in another because the database physically rejects it. That is a stronger guarantee than any amount of careful application code, because it holds even when the code is wrong.
- Composite foreign keys on every relation
- Tenant column on every table
- Query-level scope enforcement
- Dedicated database available on Enterprise
- Cross-tenant write raises an exception
- Verified by automated tests
A role decides what you may do AND which rows you may see
Permissions are explicit and exact — there are no wildcards, so adding a new dangerous permission does not silently grant it to everyone who already had a related one. Alongside them sits a data scope: own, team, location or everything. Both are applied server-side on every request.
- Exact-match permissions, no wildcards
- Four data-scope levels
- Scoped API tokens that narrow, never widen
- Read-only support impersonation
- Session and device history
- MFA support
A trail you can actually use in an investigation
Every create, update, delete, login, permission change and export is recorded with the actor, their IP, their device, the route, and a field-level diff of what changed. Secrets are redacted and personal data is masked, so the trail is safe to read without becoming a second copy of your customer database.
- Field-level before/after diffs
- Actor, IP, device and browser
- Impersonated actions marked as such
- Secrets redacted, PII masked
- Immutable and append-only
- Searchable and exportable
Where it lives and how long it stays
Data is stored in Mumbai (ap-south-1), encrypted at rest and in transit. Backups are encrypted and retained 30 days. If you leave, your data is retained for 90 days so you can export it, then deleted.
- TLS 1.2+ in transit
- Encryption at rest
- Mumbai region residency
- 30-day encrypted backups
- 90-day post-cancellation retention
- Self-serve export at any time
What we have, and what we don’t
Rather than a wall of badges, here is the honest state of our compliance posture.
In place today
- ✓Encryption in transit and at rest
- ✓Composite-key tenant isolation
- ✓Full audit trail with diffs
- ✓Role-based access with data scope
- ✓Indian data residency
- ✓Encrypted daily backups
- ✓Rate limiting and brute-force protection
- ✓Signed webhook verification
- ✓Secrets encrypted with a rotatable key
On the roadmap
- ○SOC 2 Type II audit
- ○ISO 27001 certification
- ○SAML / SSO for Enterprise
- ○Customer-managed encryption keys
- ○Published penetration test summary
- ○Formal DPA template for all tiers
We would rather tell you what is genuinely pending than display a badge we have not earned. If a certification is a hard requirement for your procurement, talk to us about timelines.
Send us your security questionnaire
We answer them properly, usually within two business days, and we will tell you plainly where the answer is “not yet”.