Data Isolation and Security Controls

Logical Isolation

• We leverage row-level security and tenant-specific identifiers to ensure data separation in shared environments.
• Access to data is restricted to authorized users within your organization, enforced by application and database-level permissions.

Encryption

• Data at Rest: Sensitive customer files are encrypted using AES-256 with a key generated for that tenant and stored in AWS Systems Manager Parameter Store. The key is not shared with other tenants. All other data is protected by AWS default encryption at rest (for example, S3 default bucket encryption and other service-native encryption).
• Data in Transit: Communications between customers and our platform are secured with TLS to prevent eavesdropping or tampering.

Related platform controls

• VPC, Private Subnets, and Service Connectivity — where application compute runs relative to the public internet.
• AWS WAF for API Protection — edge rate limiting and managed rule visibility on the API.
• Authentication with Amazon Cognito — MFA, password policy, and authentication log retention.
• Scanning Policy: Protected Domains and Blocked Capabilities — static domain deny lists and per-account blocked capabilities.