Our Security Commitment
As a security platform, we hold ourselves to the highest standards. We process sensitive security event data from your infrastructure, and we take that responsibility seriously. Our security program is built on defense-in-depth principles and continuous improvement.
SOC 2 Type II
Independently audited annually. Our SOC 2 report is available to customers and prospects under NDA.
ISO 27001
Certified information security management system covering all aspects of our platform and operations.
Penetration Testing
Quarterly third-party penetration tests by independent security firms. All findings remediated within SLA.
Infrastructure Security
- Hosting: Multi-region deployment on ISO 27001 certified cloud infrastructure with geographic data residency options
- Tenant Isolation: Strict data separation between customers at the storage, processing, and network layers
- Network: DDoS protection, Web Application Firewall, and rate limiting on all endpoints
- Access Control: Zero-trust internal architecture with mandatory MFA and just-in-time access for all employees
- Monitoring: 24/7 security monitoring with automated anomaly detection on our own infrastructure
- Backup: Encrypted backups with point-in-time recovery and cross-region replication
Application Security
- Encryption: AES-256 at rest, TLS 1.3 in transit. All API keys and secrets are hashed with bcrypt
- Secure SDLC: Mandatory code review, SAST/DAST scanning, and dependency vulnerability scanning on every commit
- API Security: OAuth 2.0 authentication, scoped API tokens, request signing, and comprehensive rate limiting
- Audit Logging: Immutable audit logs for all administrative actions with tamper-evident storage
- Incident Response: Documented IR plan with defined roles, tested quarterly via tabletop exercises
Responsible Disclosure
We welcome security researchers to report vulnerabilities responsibly. If you've found a security issue in our platform, please contact us.
- Report vulnerabilities to security@cybersec.review
- We respond to reports within 24 hours
- We do not pursue legal action against good-faith researchers
- Critical vulnerabilities are eligible for our bug bounty program (up to $5,000)
- We publish a security hall of fame for acknowledged researchers
Questions?
For security inquiries or to request our SOC 2 report, contact security@cybersec.review.