Trust Center
The record is the evidence. So is how we protect it.
Your inspection history is a defensible record. We hold it to the same standard: controls mapped to the SOC 2 Trust Services Criteria, data that stays where you put it, and access scoped to the job.
- Encrypted in transit and at rest
- Tenant isolation at the query layer
- Append-only audit trail
Compliance status
Where our attestations stand, stated plainly.
We publish status, not claims. A framework is marked attested only when the report or certificate is in hand.
SOC 2 Type II
Security, Availability, Confidentiality
Independent examination of our controls over a continuous observation window.
SOC 2 Trust Services Criteria
Five criteria. Mapped to how the platform actually works.
Common Criteria
Security
Tenant data is isolated at the query layer, secrets live in a managed vault (never in code), and every build runs SAST and DAST in CI before it ships.
A-series
Availability
Offline-first by architecture: the field app keeps working without a network and syncs on reconnect, so an outage upstream never stops the inspection.
C-series
Confidentiality
Data is encrypted in transit and at rest. Access is scoped by role and segregation-of-duties, so people see only the records their job requires.
P-series
Privacy
We collect what the work requires and no more. Personal data is scoped by role, so people see only the records their job requires.
PI-series
Processing integrity
Every calculation cites the standard it was run to, and exports the path it took, so a result is checkable, repeatable, and defensible later.
The posture
Built to be audited.
Operational controls
Isolation, access, and a record that remembers.
Tenant isolation
One tenant cannot read or reach another tenant's records. Isolation is enforced where the data is queried, not bolted on above it.
- Multi-tenant isolation, enforced at the query layer
- Managed key vault, no secrets in code
- Static and dynamic security testing in every CI build
RBAC and least privilege
Access is granted by role, enforced by segregation-of-duties, and reviewed. People get the narrowest access their job needs.
- Role-based access control across the platform
- Segregation-of-duties rules on sensitive actions
- Least-privilege defaults, access reviewed on a schedule
Audit trail and immutability
Who did what, when, and to which record: captured as an append-only history that the record assembles from, not an afterthought.
- Append-only event history per record
- User, timestamp, and action on every change
- Exportable for audit as a single query
Hosting and infrastructure
Where the record lives, and what stands in front of it.
The record lives on managed infrastructure, behind private network paths.
Hosted on Microsoft Azure
Production runs in Azure's US regions. Compute is containerized, images come from a private registry, and infrastructure is managed as code.
Private paths to data
The database tier on MongoDB Atlas, caches, and storage are reached over private endpoints. Data services have no public network path.
Guarded at the edge
A web application firewall fronts the application. TLS protects data in transit, AES-256 protects it at rest, and secrets live in a managed key vault, never in code.
Monitored like an instrument
Availability, error-rate, and response-time alerts page the team from centralized logs. A dedicated alert fires if an audit write ever fails.
Governance documentsPrivacy PolicyTerms of ServiceCookie PolicyDPA and sub-processor list available on request.
Responsible disclosure
Found something? Tell us. We will work it with you.
- Report in good faith; give us reasonable time to remediate before any public disclosure.
- Do not access, modify, or exfiltrate data that is not yours, and avoid privacy violations or service disruption.
- We will not pursue good-faith research that follows this policy.
Disclosure channel
Send findings, with steps to reproduce, to our security inbox. Encrypt sensitive details if you can.
hello@intellispec.comSecurity disclosures are routed through the monitored intelliSPEC contact path.
Answers
What a security team asks first.
How do you handle role-based access and segregation of duties?
Access is granted by role, defaults to least privilege, and is reviewed on a schedule. Segregation-of-duties rules gate sensitive actions, so the person who records a result is not the person who signs it off.
How is one tenant isolated from another?
Customer data is isolated at the query layer, so one tenant cannot read or reach another tenant's records. Secrets live in a managed vault, never in code, and every build runs SAST and DAST in CI before it ships.
What is your vulnerability disclosure process?
Security researchers can report findings in good faith to our monitored inbox. We acknowledge, investigate, and keep you posted through to a fix, and we will not pursue good-faith research that follows the policy above.
Where does your SOC 2 stand today?
SOC 2 Type II readiness is in progress. We publish status, not claims: nothing on this page is marked attested until the report is in hand.
What can you share for due diligence today?
Tell us what your security team needs to review and we will share our current attestation status and a controls overview. Start from the demo form or email our security team directly.
Put us through your security review.
Tell us what your security team needs to review. We will share our current attestation status and a controls overview.