Trust Center

Our security program is built around defense-in-depth principles, production monitoring, access review, and incident response planning. Security reviews are part of the engineering process, and enterprise customers can review architecture, data flow, and control posture during procurement.

The production database (Amazon Aurora PostgreSQL) and its automated backups are encrypted at rest with customer-managed AWS KMS keys, which use AES-256. Traffic to the CDN and load balancer negotiates TLS 1.3 where the client supports it; TLS 1.2 is the lowest version accepted. Enterprise security review can cover key management, backup retention, and hosting architecture for your rollout.

Role-based access with scoped permissions controls who sees data, workflows, and admin settings. SAML SSO and SCIM v2 directory provisioning are implemented. Audit logging covers administrative and data-changing actions; coverage per action, log retention, and export are scoped as part of enterprise rollout and security review.

Your data is not used to train foundation models. Data processing agreements are available on request, and enterprise privacy review can cover retention, deletion, subprocessors, and regional requirements.

Every pull request is scanned before it can merge: static analysis (Semgrep), secret scanning (gitleaks), dependency advisories (cargo audit and npm audit), infrastructure-as-code scanning, and SBOM generation. To be explicit: an independent third-party penetration test has been scoped but has not yet been performed, so we have no assessment report to share. We will publish the assessment date here once one is complete. Report a suspected vulnerability to security@adrata.com.

The list above is the set of third parties that hold Adrata-issued credentials and process customer data in production, plus the integrations that receive data only after a customer connects their own account. Vendor entries are tracked in an internal registry that is re-validated by a daily automated job. Adrata gives advance notice of material subprocessor changes; the notice period that applies to you is the one in your agreement.