Security
A compliance platform has to be trustworthy first
You are handing us a map of your controls and weaknesses. Here is how we protect it — and where we are still building.
Tenant isolation
- Every tenant-scoped table carries a tenant id and a PostgreSQL row-level-security policy
- The runtime database role cannot bypass row-level security — verified by an automated test
- Cross-tenant lookups exist only as a small set of narrowly-scoped database functions
Identity & access
- Argon2 password hashing, short-lived access tokens and httpOnly refresh cookies
- Role-based permissions enforced on every mutating endpoint
- OIDC single sign-on and SCIM 2.0 user provisioning
- Account lockout after repeated failed sign-ins
Data & secrets
- Integration secrets are stored as references to a secret manager, never in application tables
- Managed identities for cloud-hosted components — no static credentials in containers
- Evidence files kept in private object storage, never publicly addressable
- Encryption in transit; encryption at rest via the underlying managed services
Auditability
- Append-only audit log — the runtime role cannot delete entries
- Every check result is retained with its inputs, timestamp and hash
- Reports state their methodology and data freshness, so figures can be reproduced
Engineering practice
- Schema changes only through reviewed migrations
- Automated tests run against a real database, not mocks
- Dependency, secret, static-analysis and container scanning in the pipeline
- Read-only cloud checks by default — no automatic changes to your environment
Where we are, plainly
AssureLoom has not yet completed an independent penetration test or a SOC 2 / ISO 27001 audit of its own. We won't claim certifications we don't hold. If your procurement process needs specific assurances, ask us — we'll answer directly.
To report a vulnerability, email hello@assureloom.com.
See your real compliance posture, not a spreadsheet of it.
Book a walkthrough and we'll run the checks against a sample environment so you can see every verdict traced back to its evidence.