Security at IsoFort.

01 How we think about it

Three commitments shape every decision below.

• Assume the breach. Controls are layered so that no single failure exposes customer data. Personal data is encrypted at the field level, not just at the disk, precisely because a stolen disk image should be worthless.
• Nothing important happens on one click. Erasing a data subject, filing a regulatory report and promoting a model each require approval from two different people. The same voting mechanism enforces all three.
• The record is append only. The audit trail can be added to and read. It cannot be quietly edited, including by us.

02 Architecture and isolation

03 Encryption and key management

• In transit: TLS on all external connections, including between the platform and every third party provider it calls.
• At rest: full encryption of the database, storage and backups using managed keys.
• Field level: personal data and multi-factor secrets are encrypted individually before they are written, using envelope encryption. A customer managed root key protects per record data keys, so key rotation does not require touching the data.
• Searchable without exposure: where a field must be looked up, we use a blind index rather than storing it in the clear.
• Secrets: credentials live in a managed secrets store, never in the repository, never in an environment file on a developer machine. Application code reads them at runtime.

04 Access control

• Role based access across the product, with distinct roles for analysts, compliance officers, administrators and platform staff. Permissions are granted by role, not by exception.
• Multi-factor authentication is mandatory for every privileged and administrative role. It cannot be turned off on request.
• Two person approval gates the actions that cannot be undone: data subject erasure, regulatory filing and model promotion.
• Append only audit trail records who did what, to what, and when. Sensitive read access is logged, not only writes.
• Least privilege on infrastructure. Human access to production runs through scoped identity accounts with no standing root credentials.
• Offboarding is same day. Access is revoked when someone leaves, and the revocation is evidenced.

05 Application security

• Changes go through version control, review and an automated pipeline. Type checks, the full unit and integration test suite, and a production build must pass before anything ships.
• Dependencies are scanned for known vulnerabilities, and the pipeline fails on a critical finding rather than warning about it.
• Input is validated at the boundary. Database access goes through a typed query layer, which removes whole classes of injection.
• Rate limiting and abuse controls protect authentication and the public API.
• Secrets scanning runs against the codebase to catch a credential before it is committed.
• In July 2026 we ran a full internal security audit across access management, network exposure, data protection, logging, change management and dependencies, and closed the findings it raised. It was an internal exercise, and we describe it as one.
• Authorised customer penetration testing is welcome. Schedule it with us in advance at security@isofort.ai.

06 Logging and monitoring

Application, infrastructure and edge logs are centralised and retained for investigation. Error and exception monitoring runs with personal data scrubbing enabled, so a stack trace does not become a data leak. Alerts route to an on call responder with a defined acknowledgement target rather than to an inbox nobody watches.

07 Backup and recovery

Backups that have never been restored are a hope, not a control. Ours are tested.

Recovery time above covers the database restore. Full service recovery adds the application cutover, which the runbook covers step by step.

08 Incident response

We run a written incident response and on call policy, reviewed at least annually and after any change to staffing or hosting. Incidents are classified by severity, and each severity carries its own clock.

Where we are a processor, the notification goes to you as controller so you can meet your own regulatory clock. We give you what you need to file, and we give it to you early.

09 Vulnerability disclosure

If you found something, we want to hear it. Report to security@isofort.ai. A PGP key is available on request.

Our commitments to you

• We acknowledge every submission within 24 hours.
• We tell you our assessment and our remediation plan, and we keep you updated until it is closed.
• We credit you publicly if you want the credit, and stay quiet if you do not.
• We will not pursue legal action against research conducted in good faith and within the rules below.

What we ask of you

• Test only against accounts and data you own. Do not access, modify or exfiltrate anyone else data.
• No denial of service, no volumetric testing, no social engineering of our staff, customers or suppliers, and no physical attacks.
• Give us reasonable time to fix the issue before you publish.
• Send enough detail to reproduce it. A vague report is hard to act on.

10 People and suppliers

• Staff and contractors are bound by confidentiality obligations, receive security awareness training, and are granted only the access their role requires.
• Access rights are reviewed periodically, and revoked on the day someone leaves.
• Every supplier that processes personal data on our behalf is assessed before engagement, bound by a data processing agreement, and reviewed at least annually.
• The categories of supplier we use are listed in the privacy policy. The register naming each one is available under a mutual non disclosure agreement.
• Customers are notified at least 30 days before a new sub-processor begins processing their data.

11 Trust center

Where our compliance work actually stands, stated plainly.

"Readiness in progress" means the technical controls an auditor tests are implemented, and the organisational evidence collection is still being completed. We will say "certified" on the day a report exists, and not a day earlier.

What you can request

Request any of these at security@isofort.ai. Privacy and data protection questions go to privacy@isofort.ai.