Security Practices

How we protect your data.

Security is built into every layer of the GΞIST platform. We are transparent about what is operational today and what is on our roadmap.

Operational35 controls
In Progress0 in progress
Planned4 planned

Authentication & Access

Enterprise single sign-on, multi-factor authentication, and role-based access ensure only authorized users access your data.

  • SAML 2.0 and OpenID Connect SSO
  • MFA enforced via your identity provider
  • Role-based access control at every level
  • Per-tenant data isolation on every request

Data Protection

Your data is encrypted at rest and in transit, with strict tenant isolation ensuring no cross-customer data access.

  • TLS 1.2/1.3 encryption for all connections
  • Encrypted backups with EU and NA storage options
  • Row-level database isolation between tenants
  • Secrets stored in a dedicated vault with access logging

AI Governance

We never train AI models on your data. Every AI interaction is logged, PII is redacted before processing, and humans stay in control.

  • Your data is never used for model training
  • Automatic PII redaction before AI processing
  • All AI outputs require human review and approval
  • Quarterly governance reports on AI usage patterns

GDPR & Privacy

Full data subject rights support, complete data erasure on request, and transparent data residency controls.

  • Self-service data access and export requests
  • Complete data erasure across all systems on request
  • You choose where your data is stored (EU or NA)
  • Data retention policies with automated enforcement

Infrastructure

Multiple layers of protection from network edge to database, with continuous monitoring and incident response.

  • DDoS protection and web application firewall
  • Input validation on every API endpoint
  • Dependency and supply chain scanning on every push
  • Continuous monitoring with distributed tracing
  • Defined incident response procedures (P0-P3)
Data Residency

You choose where your data lives.

Our default deployment stores all data within the European Union. North American hosting is available for customers who require US-based data residency.

European Union (Default)

  • Application and database hosting in Germany
  • Encrypted backups in Netherlands
  • AI processing in EU region
  • No data transfer outside the EU

North America (Available)

  • US-based hosting via Azure (East US / West US)
  • SOC 2 and HIPAA compliance support
  • CCPA consumer data rights
  • Contact us for NA deployment details
Detailed Controls

Full control inventory.

For security reviewers who need the complete picture. Each control is mapped to its current implementation status. For detailed evidence, request our Evidence Pack.

Authentication & Access Control

Identity verification, session management, and role-based access enforcement.

#ControlStatus
1SAML 2.0 SSOOperational
2OpenID ConnectOperational
3MFA passthroughOperational
4Argon2id password hashingOperational
5ES256 JWT signingOperational
6Session managementOperational
7Role-based access controlOperational
8Tenant role-based accessOperational

Data Protection

Encryption, tenant isolation, and backup security across all data layers.

#ControlStatus
9TLS 1.2/1.3 in transitOperational
10Tenant isolation (RLS)Operational
11Encrypted backupsOperational
12Secrets managementOperational
13Credential validationOperational
14Volume-level encryption at restOperational
15Application-level per-tenant encryptionPlanned

AI Governance

Controls ensuring responsible, transparent, and auditable AI usage.

#ControlStatus
16PII redaction before AI processingOperational
17AI content labellingOperational
18AI audit loggingOperational
19No training on customer dataOperational
20Human-in-the-loopOperational
21AI governance reportingOperational
22Rubber-stamping detectionOperational
23AI training certificationOperational

GDPR Compliance

Data subject rights, residency, retention, and lawful basis controls.

#ControlStatus
24DSAR managementOperational
25Right to erasure (Art. 17)Operational
26Tenant purge capabilityOperational
27Deletion audit trailOperational
28Data residency controlsOperational
29Lawful basis: Legitimate InterestOperational
30Data retention managementOperational

Infrastructure Security

Network architecture, application hardening, and operational monitoring.

#ControlStatus
31Input validationOperational
32OWASP protectionOperational
33Rate limitingOperational
34Cloudflare DDoS/WAFOperational
35OpenTelemetry monitoringOperational
36Incident response proceduresOperational
37Dependency and supply chain scanningOperational

Testing & Assurance

Independent security testing and accessibility compliance.

#ControlStatus
38Penetration testingPlanned
39WCAG 2.1 AA accessibilityPlanned