How we protect your data.
A security company should be able to show its own homework. Here is how Irate is built and secured, in plain language: to ISO/IEC 27001 and SOC 2.
- Every client runs in its own tenant with its own encryption key and secrets
- Incidents and investigation trails stored per client, encrypted at rest
- A trail can only be read from its own client’s storage, enforced in code
- Point-in-time recovery on incident data
- Identity-aware access at the edge for every console host
- Origin accepts only authenticated traffic from that edge
- Web application firewall in front of the console
- Read-only viewer role; operator controls never reach viewer browsers
- Investigation is autonomous; changes to your environment need human approval
- Workflow execution blocked unless enabled per client
- Explicit verdict and confidence on every investigation; “insufficient” when evidence is missing
- Trails redacted by allow-list; prompts, model reasoning and configuration never shown to clients
- Structured audit events for views, hunts, triage and approval decisions
- Who, what, when and from where. Never content, tokens or prompts
- Approval expiries recorded and never actioned silently
- Information security management certified to ISO/IEC 27001
- SOC 2 Type I report available to clients and prospects under NDA
- Client data hosted in AWS Sydney (ap-southeast-2)
- Encryption in transit and at rest, keys held per client
- No third-party analytics, advertising or tracking scripts
- Fonts and assets served from our own domain
- Strict security headers: CSP, HSTS, frame denial, no-sniff
- Form submissions used only to reply to you
Found a vulnerability in Irate?
Email [email protected] with details and steps to reproduce. We acknowledge reports within two business days and will not pursue good-faith research. See also security.txt.