Security First Enterprise-grade security controls with continuous monitoring and improvement.
Our security program is built around defense-in-depth principles, production monitoring, access review, and incident response planning. Security reviews are part of the engineering process, and enterprise customers can review architecture, data flow, and control posture during procurement.
Data Encryption The production database and automated backups use AWS KMS encryption; public service endpoints use HTTPS.
The production database (Amazon Aurora PostgreSQL) and its automated backups are encrypted at rest with customer-managed AWS KMS keys, which use AES-256. Traffic to the CDN and load balancer negotiates TLS 1.3 where the client supports it; TLS 1.2 is the lowest version accepted. Enterprise security review can cover key management, backup retention, and hosting architecture for your rollout.
Access Controls Role-based access, SAML SSO, SCIM provisioning, and audit logging.
Role-based access with scoped permissions controls who sees data, workflows, and admin settings. SAML SSO and SCIM v2 directory provisioning are implemented. Audit logging covers administrative and data-changing actions; coverage per action, log retention, and export are scoped as part of enterprise rollout and security review.
Privacy Privacy review, DPA support, and model data controls. Your data stays yours.
Your data is not used to train foundation models. Data processing agreements are available on request, and enterprise privacy review can cover retention, deletion, subprocessors, and regional requirements.
Vulnerability Management Security checks apply according to the change type. No third-party penetration test has been completed yet.
Applicable engineering gates include static analysis, secret and dependency scanning, infrastructure checks, and release SBOM generation. Checks run according to change type. An independent third-party penetration test has been scoped but has not yet been performed; no report is available. Report a suspected vulnerability to security@adrata.com.
Subprocessors The third parties that process customer data in production, listed here and on the Sub-processors page.
The list on this page is the set of third parties that process customer data in production, plus the integrations that receive data only after a customer connects their own account. The Sub-processors page (adrata.com/subprocessors) gives the purpose, the data each receives, and where it processes it. We update that page before a new sub-processor begins processing customer data, and at least 30 days before any change that affects data held for our customers.