// security
Security
Alitycs holds behavioural data about your users, which makes us a place your customers' trust passes through. This page describes the controls behind that, in the detail a security reviewer needs.
How we think about security
Analytics data is unusually revealing. A single workspace can show who signed up, what they tried, where they gave up and when they came back. None of that is secret on its own, and all of it together is sensitive. We design on the assumption that the worst outcome is not downtime but disclosure.
So the controls below are weighted towards keeping data separated, keeping human access rare and accountable, and keeping the blast radius of any one mistake small. We would rather have fewer moving parts we understand than more parts we hope are configured correctly. Where we have not finished something, we say so on this page rather than implying otherwise — the bracketed values are real gaps, not formatting.
Controls
What is in place today, grouped the way a security questionnaire asks about it.
Infrastructure and network
Production runs on managed cloud infrastructure in private networks. Nothing but the load balancers is reachable from the public internet, administrative interfaces are not exposed, and every service talks to its neighbours over authenticated internal endpoints.
Encryption in transit and at rest
TLS is required on every endpoint — ingestion, query and application. Plain HTTP is redirected, never served. Event data, object storage and backups are encrypted at rest, and secrets are stored encrypted or hashed, never in plain text.
Access control and least privilege
Access to production is role-based, granted for a stated business reason, protected by multi-factor authentication, and reviewed on a defined cycle. Engineers do not browse customer data; access to it is exceptional, logged, and time-bound.
Authentication and API keys
Keys come in two kinds and the split is deliberate. A publishable key (pk_) is write-only and safe to ship in client code; a secret key (sk_) stays on your server and can read. Both are scoped to one workspace and can be rotated or revoked instantly. How authentication works.
Logging and monitoring
Authentication events, API key operations and administrative actions are logged with an actor and a timestamp, protected against alteration, and monitored for anomalies. Alerts page an engineer; the rota and its coverage hours are [on-call coverage and escalation path].
Backups and recovery
Encrypted backups run automatically, restores are tested on a schedule, and ingestion is buffered so an incident on the query side does not lose events. The backup frequency, retention and restore-test cadence are recorded in Annex II of the DPA.
Secure development
Every change is peer-reviewed before merge and released through an auditable pipeline with a rollback path. Continuous integration runs automated tests plus dependency and secret scanning. Development and staging never hold production data.
Vendor management
Subprocessors are assessed before we engage them, bound by written data protection terms no weaker than our own, and reviewed on a defined cycle. Customers are notified before a new subprocessor starts handling their data.
Personnel security
Background checks where the law allows, confidentiality obligations that survive departure, security and data protection training on joining and periodically after, and prompt deprovisioning when someone leaves.
Where your data lives, and when it leaves
You should be able to answer these questions about any vendor. Here are our answers.
| Data | Where it lives | How long we keep it |
|---|---|---|
| Event data | [primary hosting region], with [additional regions available] for customers who need them | The retention window of your plan — [event retention window by plan] — or until you delete it |
| Account and workspace records | The same region as the workspace | For the life of the account, then [account retention period after closure] |
| Backups | [backup storage region] | [backup retention period], then overwritten on rotation |
| Security and audit logs | [log storage region] | [security log retention period] |
| Support conversations | [support tooling region] | [support retention period] after the conversation closes |
Deleting data
You can delete events, users and whole workspaces from the application or the API at any time. Deletion removes the data from the live service within [live deletion window]; encrypted backups are not individually erasable, so deleted data ages out on the backup rotation within [backup retention period] and stays protected until it does. We confirm deletion in writing if you ask.
What leaves the platform
Four things, and nothing else. We do not sell data, we do not share it for advertising, and we never use one customer's event data to serve another.
- Exports you trigger. Query results, CSV downloads and API reads, going wherever you send them.
- Subprocessors. The providers listed at [subprocessor list URL], each bound by written data protection terms, each notified to you before it starts.
- Legally compelled disclosure. Only against a valid demand, narrowed as far as we can narrow it, and with notice to you unless we are legally prevented from giving it.
- Support access, with your agreement. When you ask us to look at something, access is scoped to your workspace, time-bound and logged.
Compliance
We would rather show you the controls than a badge. Where a claim is not yet settled, this page says so instead of guessing.
| Framework or regime | Where we stand |
|---|---|
| SOC 2 Type II | Our marketing describes Alitycs as SOC 2 Type II. Before this page leaves draft that claim needs substantiating here: the report's scope, observation period, auditor and availability under NDA are recorded at [SOC 2 report scope, period, auditor and availability]. |
| GDPR and UK GDPR | Handled contractually through our data processing addendum, which carries the standard contractual clauses and both annexes. The formal compliance statement is [GDPR compliance statement — pending counsel]. |
| Other certifications | [other certifications and roadmap]. We do not claim a certification we do not hold, and anything not named on this page is not claimed. |
| Independent testing | [independent security testing — scope, cadence and whether a summary is shareable]. |
| Subprocessors | The current list, with each entity's role and location, is published at [subprocessor list URL]. |
The contractual side lives in the data processing addendum — roles, instructions, subprocessor rights, transfer mechanism and both annexes. What we hold about you as a controller, and the rights you have over it, are in the privacy policy.
Report a vulnerability
If you have found something, we want to hear about it, and we will treat the report as a favour rather than an accusation.
Email security@alitycs.com. You do not need an existing relationship with us, and you do not need to be a customer.
What helps us act quickly
- A description of the issue and what an attacker could do with it.
- Steps to reproduce, with the exact requests, accounts and timestamps involved.
- The affected host or endpoint, and whether you touched real customer data.
- How you would like to be credited, if you would like to be.
What you can expect from us
We acknowledge reports within [acknowledgement timeframe], give you an assessment within [triage timeframe], and update you at least every [status update cadence] until the issue is closed. Target fix times by severity are [remediation targets by severity]. We will tell you when the fix ships, and we are happy to credit you publicly.
Safe harbour
If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we will treat your work as authorised under computer misuse and anti-circumvention law where it is ours to authorise. The precise scope of that commitment is [safe harbour scope — pending counsel].
Please do, in exchange:
- Stop at the point where you have proved the issue exists, and do not access, modify or keep anyone else's data.
- Avoid denial of service, spam, social engineering and physical attacks on our staff or offices.
- Test against your own workspace and your own accounts wherever that is possible.
- Give us [coordinated disclosure window] to fix the issue before you publish, and talk to us if you need to move faster.
The rest of the paperwork
These four documents are written to be read together. Each one assumes the others.
Privacy policy
What we hold about you as a controller, and what we only ever hold on a customer's behalf.
Read itTerms of service
Accounts, acceptable use, data ownership, fees, liability and how either of us ends the agreement.
Read itData processing addendum
Processor terms, subprocessors, transfers, and the two annexes your reviewers will ask for.
Read itVulnerability reports and security reviews: security@alitycs.com. A real person reads everything sent there.
Running a security review?
Send us your questionnaire. Most of what reviewers ask for is already written down, and we would rather point you at the document than retype it into a spreadsheet.
Subprocessor list: [subprocessor list URL]. Data protection contact: privacy@alitycs.com.