Security & Compliance
Every claim on this page traces to a specific control already described elsewhere on this site, in the docs, or in our public claim register. Where we have not made a commitment yet, this page says so in plain, bracketed text instead of implying one.
How tenant data is isolated
Every workspace table carries PostgreSQL Row-Level Security, and every query is scoped by instance_id at the application layer as well, so a mistake in one layer does not, by itself, expose another organization's data. Per-organization isolation extends to API keys: each tenant receives an HMAC-derived key that is cryptographically bound to its instance, with admin and viewer keys kept separate.
Report embeds are authenticated the same way. Every embed URL is HMAC-SHA256 signed with a per-tenant secret and carries an expiry timestamp, cryptographically bound to that tenant's instance the same way API keys are.
Independent architecture review
The platform architecture has been reviewed against the AWS Well-Architected Framework across multiple rounds, with all CRITICAL and HIGH findings resolved. This page states that claim without a specific round count. The number of rounds is not what we are asking you to trust here; the resolved findings are.
Automated testing
The platform ships 1,900+ automated tests, including dedicated security and tenant-isolation suites. Every code change runs through CI with build verification, unit tests, and live infrastructure smoke tests before it reaches production.
This website's own test count is not printed on this page. It changes with every commit, so a number written here would be stale before you finished reading it. Run npx vitest run in the repository for the live count, or see our public claim register for how every figure on this site is sourced and kept honest.
How the free assessment tool protects your files
Your .rdl files never leave your browser. The free Migration Assessment runs entirely client side, using the same parsing and classification stage our conversion pipeline uses, in analyze-only mode. Nothing is uploaded and nothing is stored.
If, and only if, you ask for the emailed copy, the derived summary numbers, counts, tiers, and construct names, and the contact details you type are sent to us so we can send you the email. Your RDL content is never part of that request. For the security-conscious, an offline scanner is available to download and run locally instead, and it opens no network sockets.
Read the full privacy statement on the assessment pageRate limiting and input validation on public endpoints
The default rate limit on the platform API is 100 requests per minute per action, with per-action limits tightened further for sensitive operations. API Gateway enforces global throttling on top of that: 50 req/s (burst 100) for Admin, 100 req/s (burst 200) for Viewer.
The security test suite specifically covers SSRF prevention, SQL injection, credential masking, auth rate limiting, and cross-tenant write prevention. The API bridge uses parameterized queries, DDL/DML blocking, statement allowlists, and read-only transactions, and error responses are sanitized to strip IPs, passwords, connection strings, and tokens before they ever reach a client.
Data Processing Agreement and SOC 2
Two things regulated buyers ask for that we are not going to fake an answer to. Both are business commitments, not engineering facts, so both stay a visible placeholder until they are made.
Data Processing Agreement
[DPA_TODO: statement pending. Do not publish an availability claim until a DPA document exists.]
SOC 2
[SOC2_TODO: roadmap statement pending Steve's decision.]
We would rather show you an honest gap than a compliance badge we have not earned.
Questions a page can't answer?
A Professional Assessment engagement starts with an NDA, and we are glad to walk a security or procurement team through any of this in more detail before you send anything.