Built with governance-by-design from day one.
A compliance platform must hold itself to the standard it enforces. We’re transparent about where we are and honest about what’s still in progress.
Where we are today.
| Standard | Status | Notes |
|---|---|---|
| GDPR | Aligned | DPA available. ROPA and subprocessor register maintained. |
| CCPA | Aligned | Consumer rights request workflows operational. |
| SOC 2 Type 2 | In Progress | Controls implemented. Observation period active. Report expected in current cycle. |
| ISO 27001 | In Progress | ISMS documented and operational. Certification audit scheduled. |
| ISO 42001 (AI) | In Progress | AI management system aligned. Among the first AI governance frameworks we adopted. |
We do not describe in-progress standards as “certified.” Status updates are published as milestones are reached.
SECURITY OVERVIEW
TLS 1.3 in transit, AES-256 at rest. Customer-managed encryption keys available on Enterprise and Enterprise+ tiers.
Cloud infrastructure hardened to CIS benchmarks. EU and US regions. Private / on-prem deployment for sovereign clients.
Independent penetration testing. Continuous vulnerability scanning. Secure SDLC with mandatory code review.
Six architectural foundations, enforced by default.
Every action, decision, and escalation is timestamped and cryptographically logged. Nothing is editable after the fact.
Granular RBAC across all modules. Reviewers, admins, auditors, and investigators have strictly scoped permissions.
Confinaid processes only what is needed for risk classification. Content is not stored beyond policy requirements.
Full deployment within your own infrastructure available. No data leaves your environment — suitable for financial and government clients.
Your data remains yours. Encryption keys, retention policies, and deletion rights are controlled by your organization.
Separation of concerns is enforced at the infrastructure level — not applied as a policy after the fact.
DATA PRIVACY & ACCESS
- Confinaid staff have no standing access to your message content — any access requires explicit customer authorization and is logged.
- Classification runs inside your data residency boundary.
- Under our data-use policy, customer content is not used to train shared or external models.
- Data minimization enforced at the architecture layer.
- Role-based access control with least-privilege defaults.
- SSO / SAML and SCIM provisioning supported.
- Every access and admin action is immutably logged.
- Customer-accessible audit trail with cryptographic integrity.
Quick links to the Trust Center
For complete security documentation, our subprocessor list, DPA templates, and audit reports, visit the Confinaid Trust Center — hosted on Drata and updated as our compliance program advances.
- SOC 2 Type 2 report (under NDA)
- ISO 27001 audit documentation
- DPA templates & standard contractual clauses
- Real-time subprocessor list
- Information security policy library
- Penetration-test summaries
- Incident response policy
- Business continuity plan
- Vendor management policy
Live platform status, in one place.
For incident history, current platform status, and scheduled maintenance, see our status page.
Found a vulnerability? We want to hear from you.
We operate a coordinated disclosure program. Report security issues to security@confinaid.com — we acknowledge within 48 hours.