Your Audit Data
Is Sacred
Security is not an afterthought. Assure is built from the ground up with defense-in-depth architecture to protect your most sensitive audit information - no matter the size or sector of your organization.
Multiple layers of protection
Encryption in Transit and at Rest
TLS 1.3 for every connection; AES-256 at rest. Integration credentials and SMTP secrets are encrypted per tenant, never stored in plaintext.
Multi-Role Access Control
A user holds a primary role plus any number of secondary roles, and effective permissions are the union. Over 1,100 permission gates across the API. Assigning a role that creates a segregation-of-duties conflict requires a recorded override reason.
Multi-Factor Authentication
TOTP authenticator enrolment, enforceable per tenant, including as a second step after single sign-on. Recovery codes are issued at enrolment.
Tamper-Evident Audit Trail
Every mutating action is logged and cryptographically chained. Each record carries an HMAC of its own contents and the hash of the record before it. Editing a row breaks its HMAC; deleting or reordering rows breaks the chain. Both are detectable after the fact, by anyone, without trusting us.
Independent Verification
Audit records and generated reports are signed with published keys. A public verification endpoint lets a regulator, external auditor or committee confirm a document came from your tenant and has not changed since, without an account.
Session Controls
Configurable session timeout, concurrent-session limits, and account lockout after repeated failed logins. Refresh tokens are revocable, and revocation is enforced server-side.
Our assurance posture
We hold ourselves to the same standards we help our customers achieve, including saying plainly where a programme is still in flight.
ISO 27001
Gap assessment and ISMS establishment underway, ahead of Stage 1 and Stage 2 certification audit
SOC 2 Type II
Readiness assessment underway, ahead of the Type II observation window
ODPC Registered
Deltacraft is a registered data controller with Kenya's Office of the Data Protection Commissioner, under the Data Protection Act 2019
Penetration Tested
Independent test of the platform; findings remediated and covered by regression tests that fail against the unfixed code
The platform we are using for our own ISO 27001
Our ISO 27001 programme is in flight, and we are running it inside Assure. That is the honest version of a capability claim: the gap assessment, the Statement of Applicability, the internal audit programme and the corrective actions behind our own certification are the same surfaces we sell. What follows is the clause mapping we use ourselves.
The gap assessment is a live register, not a spreadsheet
Load the clause library, assess each control item, and the current state of readiness is the register at any moment. Assessments carry the assessor, the conclusion, the evidence behind it and the next review date.
One control, many clauses
A clause-to-control crosswalk means a control you already operate answers every framework clause it satisfies. Add ISO 22301 or NIST CSF alongside and the existing evidence carries across instead of being re-gathered.
Accepted risks have an expiry
Exceptions are first-class and time-bound: Active, Expiring, Expired. A certification auditor asking what you accepted and until when gets the register, not a recollection.
Submission packs on a cadence
Assemble a defined set of sections for a named audience on a schedule, with the last-generated and next-due dates tracked, so the certification body and the regulator are served from the same evidence base.
The same structure serves ISO 22301 for business continuity and NIST CSF. Assure does not issue certificates and is not a certification body. It is where the evidence lives when the auditor asks for it.
The full architecture and security pack
Two documents written for someone evaluating rather than browsing, including where a programme is still in flight. Sent to your work address.
Your data, your rules
Tenant Data Isolation
Each organisation's data is isolated by PostgreSQL row-level security, enforced by the database, not by application code that could forget to filter.
Retention and Defensible Destruction
Retention policies run per entity type with a dry-run default, so a schedule is reviewed before it destroys anything. Destruction method is recorded against each policy.
Legal Holds
A hold placed for live litigation, investigation or a regulator's request suspends destruction for its subjects, and actually blocks it, rather than flagging it.
Deployment and Data Residency
Deploy on our managed cloud or inside your own infrastructure on Kubernetes. Self-hosted deployments keep all processing and storage within your chosen boundary.
“We built Assure to protect the information that protects organizations. Security is foundational to everything we do.”
Have specific security questions? Our team is ready to walk you through our architecture in detail.