How ComplianceAnvil protects your data

Tenant isolation

Every record that belongs to a customer carries an organization identifier, and database row-level security policies restrict reads and writes to members of that organization. Isolation is enforced in the database itself, not only in application code, so a manipulated identifier in a URL or an API call does not grant access to another organization's data.

Authorization

Roles are stored server-side and evaluated server-side. Administrative privileges are never inferred from a client-side email address or a value the browser can change. Privileged operations verify the caller's role before executing.

Authentication

Email and password authentication with email verification and secure password reset, backed by a managed identity provider. Sessions expire, and sign-out clears cached application data.

File storage

Evidence files are stored in private storage. Files are never served from public URLs. Uploads are validated for type and size, and organization isolation applies to storage objects the same way it applies to database records.

Encryption

All traffic to the application is encrypted in transit with TLS. Data at rest is encrypted by our managed infrastructure provider.

Audit logging

Security-relevant actions — document approval, role changes, evidence deletion, administrative actions — are recorded with actor, action, target, and timestamp.

Secrets

API keys and service credentials are held in managed secret storage and are never exposed in client-side code or in application responses.

What we do not claim

We do not claim SOC 2 certification, ISO certification, HIPAA compliance, FedRAMP authorization, or the results of a third-party penetration test. If and when any of those are independently achieved and verified, they will be stated here with the assessing organization and date — and not before.

Reporting a vulnerability

Email support@employeeforge.com with details and steps to reproduce. Please do not test against other customers' data.