Security & compliance

Compliance status

We are not currently SOC 2, ISO 27001, or HIPAA certified. We build with those controls in mind — the isolation, access-control, and logging measures below — but we won't claim a certification we don't hold. If a signed DPA, security questionnaire, or a specific compliance framework is a requirement for your organisation, email legal [at] amdital.com before you sign up so we can tell you honestly whether we're a fit today.

GDPR

We honour GDPR data-subject rights for every user, regardless of where you or your workspace are based — this includes access, correction, erasure, and portability of your data (see our Privacy Policy for the full process), and we respond to requests within 30 days. This is a data-protection commitment we hold ourselves to, not an audited third-party certification — GDPR is a regulation, not a certification scheme, so we don't describe it as one.

Data isolation

Multi-tenant, with workspace data tagged with a workspace ID and scoped to the workspace making the request by the application on every query. Postgres row-level security policies exist on most tables and apply to application connections that use our restricted database role, but some server-side paths, such as background jobs and internal service operations, use a privileged database connection that bypasses row-level security. Isolation therefore rests primarily on application-layer workspace scoping, with row-level security as a partial backstop. Extending database-enforced isolation to every path is not finished, and we won't describe it as finished until it is.

Encryption

TLS in transit for every connection to our apps and API. We do not currently offer customer-managed encryption keys (BYOK) or dedicated single-tenant deployments.

Access control

Authentication runs through our own JWT-based auth system, not a third-party identity provider. Every workspace has role-based permissions, and every write is checked against the caller's role for that specific workspace before it touches data.

Monitoring & incident response

We monitor errors, performance and alerts continuously with dedicated error-tracking and monitoring tools. If an incident affects your data, we will tell you directly — we don't currently commit to a fixed public SLA on response time, and we'd rather say that plainly than invent a number.

Last updated: October 9, 2026. For questions, contact legal [at] amdital.com.