// security
Security & Architecture
Isolation, not multi-tenancy
Our environment is not a logical partition inside a shared system. It is a genuinely separate deployment, provisioned specifically for you, with no other client's data ever touching the same instance.
There is no scenario where a misconfiguration on someone else's account exposes yours, because there is nothing shared to misconfigure.
Encryption at rest and in transit
All data is encrypted at rest using AES-256, and encrypted in transit between every point it moves through.
Encryption keys are managed separately from the data they protect, and access to them is limited to what a specific operation actually requires, not held broadly by convenience.
Access Control and Logging
3-2-1 backups, tested, not assumed
Every deployment runs a 3-2-1 backup policy: three copies of your data, on two different kinds of storage, with one copy kept off-site.
Backups are only useful if they actually restore, so restore procedures are tested on a set cadence rather than assumed to work because the backup job completed.
Enterprise hardware, reused where possible
We use decommissioned, enterprise-grade hyperscaler hardware where we can, tested and certified before it goes into production.
This is deliberate: fewer new units manufactured, less equipment sent to landfill, and no compromise on reliability, since reliability comes from how hardware is tested and monitored, not how new it is. We don't publish specific hardware brands or models here, more on why in the section below.
Named jurisdiction, not implied
Your data sits in a jurisdiction we name explicitly and can state without needing to check: Singapore today, with EU coverage opening soon. Nothing replicates to a region you haven't agreed to, and there is no default cross-border movement built into how the environment works.
Why we don't publish everything
Publishing precise infrastructure specifics gives a would-be attacker a head start, withholding them is a standard security practice,
not a gap in what we're willing to tell you.
Anything you need to verify directly, jurisdiction, encryption standard, backup policy, is stated plainly above.
What stays unpublished is the kind of detail that would only be useful to someone trying to break in.
Can we bring our own security team's questions to a call?
Yes, and we'd rather you did. If your security or compliance team has a specific questionnaire, send it ahead of a call and we'll answer it directly rather than working from a generic overview.
Do you hold a formal certification like SOC 2 or ISO 27001?
We don't yet hold a formal SOC 2 or ISO 27001 certification. Our architecture is built around the same principles those frameworks require, named jurisdiction, logged access, tested backups, isolated environments, and we can walk your team through exactly how each one is implemented, which is often more specific than what a certificate alone tells you.
What happens to our data if we end the engagement?
In the event of your data being stored on our servers as backup or otherwise, it is returned to you in a usable format, and deleted from our systems on a timeline set out in the service agreement. That's a structural part of how our engagements are set up.
