Security
Built the way we ask you to build.
ISO Assist holds the evidence of your security programme, so its own has to be plain to inspect. This page is the short version; the full version is the trust page in the app and the data processing addendum.
Data residency
Your records and evidence are stored and processed in Australia. Encrypted in transit and at rest.
Tenant isolation
Every domain table carries a tenant id; every data-access path is tenant-scoped at the repository layer; Postgres row-level security is the backstop. Platform-admin paths are explicit and audited.
Authentication
Email verification, 12-character minimum, per-account lockout on the password step, TOTP multi-factor, session list and revocation.
Encryption and secrets
TLS in transit; encryption at rest on database and file storage; secrets held in a managed secret store, never in code or configuration files.
Files
Signed, expiring URLs. Deterministic upload rules: magic-byte checks, archive inspection, PDF action scan. Never executed. Served with a sandboxed content policy.
Audit log
Append-only, per tenant, exportable as CSV. Reports are archived, never deleted; hashes are immutable at the column-grant level.
AI
Works at six labelled boundaries. Your content is treated as data, never as instructions. Output is validated before it becomes a record and falls back to needs review. Every call is logged with its cost.
Application security
Nonce-based Content Security Policy, security headers, input validation on every boundary, SSRF protection on outbound fetches, fail-closed rate limiting.
Availability
Gated deployments, health checks, point-in-time recovery, versioned storage and deletion protection.
Your data, your exit
Full tenant export on request; deletion with a grace period, executed by a controlled database routine.
Ask us anything on the demo, including the hard questions.
14 days free, no card. Or book a demo and we will walk it with you.