You trust us with proof of your security. Here is how we protect it.

Stated plainly, including what we have not done yet. If you need more detail for a vendor review, we will answer your questionnaire.

Request our security pack

Azure Central Indiawhere your data is stored

Database-levelseparation between companies

SAML & OIDCsingle sign-on

Controls

How the platform is protected

Where your data lives

Hosted on Microsoft Azure in the Central India region.
Your records, evidence files and database backups are stored in India.
AI features send only the text needed for that task to our AI model provider. See subprocessors.

Each company kept separate

Every database table that holds customer data is protected by row-level security, enforced by the database itself rather than by application code alone.
Background jobs run under the same per-company scope as people do.
A check confirms that every customer-data table is covered, and is re-run after every database change.

Encryption

All traffic to the platform and this website uses HTTPS.
Data at rest is encrypted by Azure storage encryption.
Integration credentials and single sign-on secrets are encrypted a second time with a separate application key before they are stored.

Sign-in and access

Single sign-on with SAML 2.0 or OpenID Connect, so your own identity provider and its MFA rules apply.
SAML responses are signature-checked and cannot be replayed.
Repeated failed sign-in attempts are rate-limited.
Administrator actions, such as running an integration, need an administrator role.

Integrations you control

You choose which systems to connect, and you can pause or remove any of them at any time.
We ask for read-only access wherever the system offers it.
The on-premises collector only connects outwards and signs everything it sends, so you open no inbound ports.

AI with a person in charge

AI drafts answers, mappings and reports. Nothing counts until a named person on your team approves it.
Each approval records who approved it and when.
Your data is not used to train AI models under our model provider's commercial terms.

How we build

Changes are tested in a separate staging environment before they reach production.
Internal security reviews have covered tenant isolation, sign-in abuse, SAML replay and server-side request forgery. Every finding was fixed and re-tested.
Key software dependencies are pinned to exact, reviewed versions.

Backups and recovery

The production database is backed up every night.
Recovery targets are agreed in enterprise contracts.

Where we are today

What a careful buyer will ask

We would rather tell you now than have you find out in a review.

Our own ISO 27001 / SOC 2Not yet. We are a young company and are preparing for our own ISO 27001 certification, using InspireGRC to do it. We will publish the certificate here.

Independent penetration testNot yet published. We will share the summary report with customers under NDA once it is complete.

Uptime commitmentAgreed in your order form. We publish incidents to affected customers by email.

Security questionnaireWe complete your security questionnaire, with evidence.

Data Processing AgreementOur DPA is published, and we sign it with every customer.

Responsible disclosure

Found a security issue?

Email info@inspiregrc.com with the subject "Security". We reply within two working days, keep you informed, and will not take legal action against good-faith research that avoids privacy harm and service disruption. Our security.txt has the details.

Documents

Policies and agreements

See InspireGRC on your own requirements

Bring a real questionnaire or your auditor's request list. 30 minutes, no scripted demo.

Talk to us