Security
A platform that keeps evidence has to protect itself. These are the main measures.
Sign-in with MFA
A mandatory second factor, passkeys, and sign-in with Microsoft 365 or Google Workspace.
Customer isolation
Each customer sees only its own data, enforced by the database with row-level security.
Immutable evidence
Custody events are append-only, and files are stored with their SHA-256 fingerprint in immutable storage.
Controlled access
Least-privilege roles, time-limited elevation with a reason, idle sign-out, and an access log.
Minimal personal data
We do not store Social Security numbers or full background checks; only the check result and its expiry.
Data residency
Separate cells per market and a US-only access option for customers who need it.
Found a vulnerability?
Write to us from the contact page. We answer every security report.