InackGuardTrust
Security you can check.
And a plain list of what we do not have yet. Everything here describes what the product does today.
EVIDENCE CHAIN
RECORD 41
hash 9d2f…c1
prev 7c11…a0
→hash 9d2f…c1
prev 7c11…a0
RECORD 42
hash a07b…5e
prev 9d2f…c1
→hash a07b…5e
prev 9d2f…c1
RECORD 43
hash 3e90…77
prev a07b…5e
hash 3e90…77
prev a07b…5e
$ verify report-8841.zip
checking 43 records…
OK chain intact · 43/43 hashes match · exported 17 Oct 2026
checking 43 records…
OK chain intact · 43/43 hashes match · exported 17 Oct 2026
Proof, not promises
Six standards every report is held to.
CitedEvery finding names its source and dateMatchingNames, aliases and variants, scored with the reasonVerifiedDocument quotes checked word for wordReplayableAny past report re-runs against its evidenceTamper-evidentSealed records a third party can verify offlineWatchfulWatched lists checked for changes, you hear once
Evidence integrity
Records that show if they were changed.
Each piece of evidence is hashed and chained to the one before it. The database refuses edits and deletes, and the chain is checked on a schedule with an alert. Any report exports as a bundle with a small verifier script. Your auditor runs it on their own machine; they do not have to trust us.
tamper test
$ verify report-8841.zip
checking 43 records…
FAIL record 42: hash does not match its content
FAIL records 43 to 44: chain broken after 42
exit 1 · 2 records invalid
checking 43 records…
FAIL record 42: hash does not match its content
FAIL records 43 to 44: chain broken after 42
exit 1 · 2 records invalid
Record 42 was edited after the fact, so its hash no longer matches and every link after it breaks. The verifier shows exactly where.
What is in place today
Identity and access
Single sign-on with any OpenID Connect provider; email domains proven in DNS
Automatic user provisioning and removal (SCIM)
Authenticator-app MFA that an administrator can require
Roles; a provider can never grant admin
Account reviews with an exportable record
Your data
Document text deleted after 30 days; unopened previews after 14
Erasure on request, logged; legal hold to stop deletion
Organisations kept separate; cross-tenant tests
Secrets encrypted; refuses to start with weak settings
Data stored in the United States
Operations
A public status page measured from the live system
Every change runs through an automated test suite
Automatic scans for leaked secrets and vulnerable packages
Audit-log feed for your security monitoring
Structured logs with request ids
What we do not have yet
If your buyer needs one of these, you should know before you sign up.
NOT YET
SOC 2 report
No auditor engaged yet. We map our controls to it and will say here when an audit starts.
NOT YET
ISO 27001 certificate
Not certified.
PLANNED
Independent penetration test
Planned before enterprise sales.
NOT YET
SAML sign-in
OpenID Connect is supported; SAML is not.
NOT YET
Regional hosting
One region today (United States).
PLANNED
Tested disaster recovery
Targets are written down; the first restore drill is scheduled before launch.
Who receives your data
Only the providers that need a name, a document or a query to do the job, under contract. The full subprocessor list is part of our data-processing agreement and is shared with customers on request. We tell customers 30 days before adding one.
Security roadmap
In place
Single sign-on, provisioning, MFA, roles, tenant separation, encryption of secrets, audit-log feed, legal hold, erasure, measured status page
Next
Independent penetration test; tested disaster-recovery drill
Planned
SOC 2 readiness and audit; SAML sign-in; regional hosting options
Security questions
Where is data stored?+
In the United States.
Is data encrypted?+
In transit, and secrets at rest; storage encryption is set at deployment.
Do you have SOC 2?+
Not yet. Readiness work is planned; we say so plainly.
Can we get a data-processing agreement?+
Yes, with the subprocessor list.
How do you handle incidents?+
A written response plan, with customer notice as the agreement sets.
Need more detail for a questionnaire?
Ask for the security package.