We hold ourselves to the controls we test
A compliance platform sees sensitive information about your systems. These are the safeguards built into TrustNiq, and what we have not done yet.
How your information is collected, stored and returned
Read-only by design
Connectors use read-only roles and scopes. Database scans read schema and an in-memory sample; sample values are never stored, only masked shapes. TrustNiq does not change your systems.
Encryption
Evidence files, MFA secrets and integration secrets are encrypted with AES-256-GCM, with a separate key for each organisation and support for key rotation. All traffic uses TLS. Session cookies are HttpOnly, Secure and SameSite=Strict, with CSRF protection.
Secrets handled carefully
Connector credentials are referenced from environment or secret storage, and integration secrets are encrypted at rest. Secrets are never returned by the API or written to logs.
Tenant isolation
Every record is scoped to its organisation, and every API query is filtered by it. Isolation is covered by automated tests on each build.
Your data, your exit
Export all of your organisation's data at any time. On offboarding, data is deleted and a deletion certificate is issued.
Who can sign in, and who can approve what
Strong sign-in
Multi-factor authentication is required by default. Single sign-on with OpenID Connect or SAML 2.0, SCIM user provisioning, throttled logins, role-based access and read-only auditor accounts.
Separation of duties
Exceptions, attestations, DPIAs, policy versions and Statement of Applicability exclusions need a second person to approve. Nobody can approve their own request.
How we know the safeguards keep working
Tamper-evident records
Evidence is hashed with SHA-256 when collected. Every action is written to a hash-chained audit trail that you can verify from the product, and that the platform checks daily.
Security testing in every build
Static analysis, dependency audits, container image scanning and an OWASP ZAP scan run on every change, alongside end-to-end and load tests.
Hardened web delivery
A strict Content Security Policy with no inline scripts, cross-origin isolation headers, and an unprivileged web server.
Backups that are tested
Backups are encrypted, and restores are rehearsed: a drill restores into a separate database and checks every audit chain and evidence hash.
AI, only where you allow it
AI features are off until an administrator approves a provider for a specific purpose. Deterministic checks come first; AI output, such as a second reading of a contract, is verified against the source and confirmed by a person. TrustNiq does not use customer data to train models.
What we have not done yet
- Independent penetration test (planned before general availability)
- ISO 27001 certification and SOC 2 report
- Customer-managed encryption keys
- Integration with a cloud secrets manager or KMS (keys come from the server environment today)
We will update this page as each is completed.
Security questions
Is TrustNiq certified to ISO 27001 or SOC 2?
Not yet. We are building our own controls against ISO 27001 and SOC 2 and will publish certifications and reports on our trust page as we obtain them. An independent penetration test is planned before general availability.
Where is our data stored?
Customer data is held in India by default. Organisations can see and record their data residency setting in the platform.
Can TrustNiq staff see our data?
Our staff run the service from a separate control centre with its own sign-in and mandatory two-step verification. It shows account details and usage, not your evidence, findings or personal data inventories. Any action staff take on your organisation, such as a plan change, is also written to your own audit trail. TrustNiq does not use customer data to train AI models.
How do we report a vulnerability?
Please use the contact form and choose 'Security report'. We acknowledge reports within two business days and do not take action against good-faith research.
See your compliance posture on your own systems
DPDP, CERT-In, ISO 27001, SOC 2 and more. Connect one cloud account and one identity directory in a 14-day trial. No card needed.