Our Commitment to Security
- DDoS mitigation
- edge network with tenant-scoped tables isolated with row-level security
- TLS 1.2+
- on every connection, with HSTS and provider-managed encryption at rest
- 64
- resource and action permissions checked on every request
- 72h
- GDPR breach-notification clock tracked in our incident workflow
Controls
The controls behind your data
Six areas carry the weight of protecting customer data. Each one is a documented policy with a named owner and a review cadence, not a marketing claim.
Tenant isolation
Customer data is separated at the database layer, not only in application code.
- Row-level security enforced across roughly 89 tenant-scoped tables
- Tenant traffic runs as a non-privileged role, and direct database access is reserved for break-glass operations
Encryption
Data is protected in transit and at rest, with a documented and deliberately limited set of approved algorithms.
- TLS 1.2 or higher with HSTS on all customer and administrative traffic
- Provider-managed encryption at rest, scrypt password hashing, and secrets that never enter version control
Identity and access
Access is deny-by-default and role-based, and a role or membership change takes effect immediately.
- Email, OAuth and TOTP sign-in, with multi-factor authentication required for every privileged role
- 64 resource and action permissions checked at every request, with roles re-resolved on each call
Logging and monitoring
Security-relevant events are logged consistently and attributably, so an incident can be reconstructed after the fact.
- Structured logs carrying trace, tenant and user identifiers, with automatic redaction of secrets and personal data
- Audit trails are database-hardened as append-only for the application role, and a pre-deletion escrow preserves them through tenant exit
Secure development
No change reaches production without passing an enforced pipeline that human review cannot quietly skip.
- Per-change gates include linting, type checking, unit and integration tests, and static analysis that must pass before merge
- A single automated deploy pipeline, with development, staging and production running as separate environments
Incident response
A single intake channel, a severity ladder and a documented process for every security event.
- Report through our contact page, which routes to the security team
- Severity-based acknowledgement targets and a 72-hour GDPR breach clock tracked in the incident workflow
Lifecycle
Security is a loop, not a checkbox
We treat security as a continuing cycle. Every stage has an owner, a cadence and evidence behind it.
01
Identify
Keep an inventory of assets, suppliers and risks, and review it on a schedule.
02
Protect
Apply least privilege, encryption and secure defaults across every layer we operate.
03
Detect
Watch errors, uptime and anomalies, and surface what matters through alerting and human review.
04
Respond
Triage against a severity ladder, contain the issue, and meet our notification obligations.
05
Recover
Restore service, capture the lesson, and feed corrective actions back into the cycle.
Compliance
Where we are today
We would rather show an honest roadmap than a badge we have not yet earned. Here is our current position.
SOC 2 Type I
Independent point-in-time assessment of our security control design.
ISO/IEC 27001 Stage 1
Documentation review confirming our management system exists and is complete on paper.
ISO/IEC 27001 Stage 2
Operational effectiveness testing over an observation window, backed by real evidence.
Independent penetration test
External active assessment, with findings tracked to closure in our risk register.
Coordinated disclosure
Report a vulnerability
If you believe you have found a security issue in iNeedTrust, we want to hear from you. We will acknowledge your report, investigate it, and work with you on remediation.
What to include
The affected URL or component, steps to reproduce, the potential impact, and how we can reach you.
What to expect
An acknowledgement of your report and a named point of contact, followed by updates as we triage and fix.
For anything other than a vulnerability report, contact us
Ready to build trust?
Create your trust center in minutes. No security expertise required.
Or book a demo with our team·14-day free trial.