Encryption. All traffic uses TLS 1.2 or higher. Data at rest is encrypted with AES-256 using Azure managed keys. Enterprise customers may bring their own key.
Tenant isolation. Every record carries an organisation identifier, and every query is scoped to it at the database layer. Cross-tenant reads are not possible through the application.
Secrets. Credentials for connected tools and internal services are held in Azure Key Vault and never stored in code or logs.
Access. Production access is limited to named engineers, granted for a stated purpose and time, over single sign-on with hardware-key multi-factor authentication. Every access is logged.
Testing. An independent penetration test is performed at least annually and after major changes. A summary letter is available under NDA.
Monitoring. Application and infrastructure telemetry with alerting on errors, unusual access patterns and availability.
Development. All changes are reviewed before merge, dependencies are scanned, and production deploys are automated from the main branch.
To report a vulnerability, email adharsh@20xwork.ai. We acknowledge within two business days.