Security & Trust

Built to handle your most sensitive data

Identity and access data is among the most sensitive information in your organization. Here's exactly how Sifr AI protects it — and how we hold ourselves accountable.

Security Posture

Core controls protecting your identity data at every layer.

🔒

Encryption at Rest

All stored data encrypted with AES-256. Encryption keys managed separately from data with automatic rotation.

✓ Active
🔐

Encryption in Transit

TLS 1.2+ enforced on all connections. HSTS headers set. No plain HTTP accepted anywhere in the stack.

✓ Active
🛡️

Authentication

All admin access requires Auth0 SSO. MFA enforced for all team members with access to production systems.

✓ Active
📋

Audit Logging

All write-back actions, login events, and configuration changes logged with actor, timestamp, and outcome. Tamper-evident.

✓ Active
🔑

Least-Privilege Access

Internal team access scoped to job function. Sifr reads only the identity data necessary to perform governance analysis.

✓ Active
🌐

Network Isolation

Production environment isolated from development and staging. No shared credentials between environments.

✓ Active
🔍

Penetration Testing

Third-party pen testing scheduled annually. Findings remediated before next release cycle. Results summarized on request.

In Progress
⚙️

Dependency Scanning

Automated vulnerability scanning on all dependencies via GitHub Dependabot. Critical CVEs patched within 24 hours.

✓ Active

Architecture & Data Flow

How Sifr accesses and processes your identity data.

🔗 What Sifr reads from your IdP

  • User profiles (name, email, department, title)
  • Role and group assignments
  • Last login timestamps and login frequency
  • Account creation date and status
  • MFA enrollment status
  • Access log events (authentication, role changes)

🚫 What Sifr never reads

  • Passwords or credential hashes
  • Personally identifiable information beyond work profile
  • Application-level data or document contents
  • Financial records or payroll data
  • Private communications (email, chat)
  • Data outside your tenant boundary

✏️ Write-back scope (with approval)

  • Role revocation requires explicit admin confirmation
  • Every write-back action logged to tamper-evident audit trail
  • Role assignments require approval workflow completion
  • No bulk operations without explicit per-user confirmation
  • Revocations can be reviewed before execution
  • All write-backs reversible by re-assigning via IdP

🗃️ Data residency & retention

  • Hosted on Railway (AWS infrastructure, US region default)
  • EU region available for GDPR-sensitive deployments
  • Identity data cached for performance (5-minute TTL)
  • Audit logs retained for 365 days, then archived
  • Chat history retained until user deletes sessions
  • No training of AI models on your identity data

Certifications & Compliance

Where we are today and what we're actively working toward.

🏗️

SOC 2 Type II

Formal audit in progress. We have implemented the controls required for Trust Service Criteria: Security, Availability, and Confidentiality. Report expected Q3 2026.

In Progress
📋

GDPR Readiness

Data processing agreements (DPAs) available for EU customers. Data subject request workflows supported. EU-region hosting available.

✓ Available
🔐

ISO 27001

Information security management system (ISMS) policies documented and in effect. Formal ISO 27001 certification planned for 2027.

Planned 2027
🏢

HIPAA

Sifr AI governs user access — it does not store or process Protected Health Information (PHI). BAA available for healthcare customers upon request.

✓ BAA Available
📊

SOX Alignment

Access review workflows, SoD violation detection, and audit trails are designed to support SOX Section 404 compliance evidence requirements.

✓ Controls in Place

CCPA

California Consumer Privacy Act data handling requirements supported. Personal data access, deletion, and opt-out requests honored within required timelines.

✓ Active

Data Handling Principles

How we think about the data you entrust to us.

🎯 Purpose limitation

Your identity data is used exclusively to provide IAM governance analysis. It is never sold, shared with third parties for marketing, or used to train AI models.

🏷️ Data minimization

We only request the scopes required for governance analysis. If a feature doesn't need a field, we don't collect it. Permissions are reviewed quarterly.

🔒 Tenant isolation

Your data is fully isolated from other customers. No cross-tenant data access is possible by design. Each tenant's data is stored and processed separately.

🤖 AI transparency

AI risk scores are explainable — every recommendation includes the signals that drove it. The AI assistant is scoped to IAM topics only and does not access raw identity data during chat.

📤 Data portability

You can export all your data (audit logs, reviews, requests) at any time. On cancellation, all data is deleted within 30 days and a deletion receipt is provided.

🔔 Breach notification

In the event of a data breach affecting your organization, we will notify you within 72 hours in compliance with GDPR Article 33 and applicable state laws.

Internal Access Controls

How Sifr's own team accesses systems and your data.

Control Requirement Status
Multi-factor authentication Required for all team members accessing production ✓ Enforced
Production database access Engineering leads only, requires peer approval for schema changes ✓ Enforced
Customer data access No team member has routine access to customer identity data. Support access requires customer consent and is logged. ✓ Enforced
Offboarding Access revoked within 2 hours of employee termination ✓ Enforced
Secret management No secrets in source code. All credentials managed via Railway environment variables or a secrets manager. ✓ Enforced
Security training Annual security awareness training required for all employees ✓ Enforced
Background checks Background screening completed before access to production systems ✓ Enforced

Incident Response

How we respond when something goes wrong — and our commitments to you.

  1. 1

    Detection

    Automated alerting via uptime monitoring and anomaly detection on access logs. On-call engineer notified within 5 minutes of detection.

  2. 2

    Containment

    Affected systems isolated. Credentials rotated. Customer access suspended if required to limit blast radius.

  3. 3

    Customer notification

    Affected customers notified within 72 hours with: incident description, data affected, steps taken, and remediation timeline. No vague "we take security seriously" communications.

  4. 4

    Post-mortem

    Blameless post-mortem written within 5 business days. Root cause, contributing factors, and prevention measures documented and shared with affected customers on request.

Responsible Disclosure

Found a security vulnerability? We want to hear from you.

Security Vulnerability Reporting

If you discover a security vulnerability in Sifr AI, please report it privately to security@sifrhq.com. We will acknowledge receipt within 24 hours, provide a timeline within 72 hours, and keep you informed throughout remediation.

We follow coordinated disclosure — we ask that you give us 90 days to remediate before public disclosure. We do not pursue legal action against good-faith security researchers. Significant findings may be eligible for recognition in our security acknowledgements.

Security FAQ

Does Sifr AI store copies of our identity data?

Sifr fetches identity data from your IdP in real-time and caches it for a short TTL (5 minutes) to improve performance. Audit logs and access request history are stored persistently in your Sifr database. Raw identity records (users, roles) are not permanently copied — they are refreshed from source on each analysis run.

Is our data used to train AI models?

No. Your identity data is never used to train AI models — ours or OpenAI's. Sifr sends anonymized aggregated statistics (user counts, role counts) as context to the AI assistant, not individual records. We have a zero-training data policy for all customer data.

What happens to our data if we cancel?

Upon cancellation, your data is deleted within 30 days of account closure. You will receive a deletion confirmation. You can also request immediate deletion at any time by emailing privacy@sifrhq.com.

Can we get a Security Questionnaire (VSQ) completed?

Yes. For Enterprise customers, we complete standard vendor security questionnaires. Contact enterprise@sifrhq.com with your questionnaire and we'll return it within 5 business days.

Do you offer a Business Associate Agreement (BAA) for HIPAA?

Yes. Sifr AI governs access to systems — it does not store or process Protected Health Information. A BAA is available for healthcare organizations requiring it as part of their vendor due diligence. Request one at legal@sifrhq.com.

What infrastructure does Sifr run on?

Sifr AI is hosted on Railway, which runs on AWS infrastructure. Our default deployment is in the US East region. EU-region hosting (AWS eu-west-1) is available for European customers with data residency requirements.