Security
Security, stated plainly
What protects your data today, and what we have not finished yet.
In place today
- Available today Tenant isolation in the databaseRow-level security on every tenant table; no query runs without a tenant context.
- Available today Encryption of sensitive fieldsSensitive fields and files are encrypted with per-tenant keys that can be destroyed on offboarding.
- Available today Malware scanningEvery upload is scanned before it can be downloaded.
- Available today Audit trailAn append-only audit ledger records who did what, when.
- Available today Single sign-on through your identity providerPasswords stay with your identity provider; Telegrade never stores them.
- Available today Platform staff accessOur own staff sign in with multi-factor authentication from a restricted network, and every access is logged.
- Available today Hardened web deliveryStrict content security policy, no third-party scripts, HTTPS only.
- Available today Secrets in a vaultCredentials live in a managed key vault, never in code or configuration files.
- Available today Regional hostingEach institution's data is stored in the region it chooses.
- Available today Retention and erasureRetention schedules, legal holds and verified erasure.
Not yet in place
We list these so nobody has to guess.
- Planned Independent penetration testAn external test of the platform before general availability.Planned (roadmap item 7.1)
- Planned Recovery drillsRegular restore drills with published recovery objectives.Planned (roadmap item 7.2)
- Planned Public status pageA status page with incident history.Planned (roadmap item 7.4)
- Planned Service level agreementA published availability commitment for paid plans.Planned (roadmap item 7.3)
Data documents
Reporting a vulnerability
If you believe you have found a security issue, contact us and we will respond. Please do not test against institutions' live data.