Security
Your documents stay yours
A certificate of analysis is commercially sensitive and usually belongs to someone else in your supply chain. Here is what actually protects it, and what we do not claim.
No pooling between customers
Documents and analyses are scoped to your organisation. Nothing you upload is combined with another customer's data, and nothing is used to train a model.
TLS everywhere, enforced
The site and the API are served over HTTPS with automatically renewed certificates, HTTP redirected, and strict transport security set for a year including subdomains. A configuration that would serve the product without TLS refuses to start rather than starting insecurely.
Private network, controlled storage
The database is reachable only on a private network inside the host, not from the internet. Object storage has public access prevention enforced, no public access grants, and object versioning enabled so an overwrite or deletion is recoverable.
Roles the server enforces
Administrator and reviewer functions are gated by role on the server, not merely hidden in the interface. Service credentials are mounted read-only rather than baked into the application environment.
Backups that leave the machine
The database is backed up nightly, and each backup is copied off-site so that losing the server does not lose the backups with it. Restores are tested rather than assumed.
Hardened response headers
Content-type sniffing off, framing denied, referrer policy restricted, and geolocation, microphone and camera denied by policy.
What we do not claim
We hold no audited security certification. We will not describe ourselves as certified, compliant or accredited when we are not. A threat model, encryption evidence and an incident-response procedure are maintained and can be shared under NDA.
Security questions
Are my documents used to improve the product?
No. Uploaded certificates and the analyses produced from them belong to your organisation and are not pooled with any other customer's data.
Do you hold a security certification?
Not today. We hold no audited certification, and we will not imply otherwise. What exists is documented: a threat model, encryption evidence and an incident-response procedure, and we will share them on request.
Where is data stored?
In managed cloud storage with public access prevention enforced and object versioning enabled, plus a database on a private network that is not reachable from the internet.
What happens to a document if I delete it?
Retention and deletion are set out in the retention policy, which the application serves directly. Deleted objects remain recoverable from versioned storage for the retention window rather than vanishing instantly.