How we keep your data + reputation safe.
We run customer UGC for regulated industries. The bar is high. The story below is what is true today, not the marketing version. Where something is on the roadmap, we say so.
99.95%
uptime · trailing 90d
eu-west-2
AWS · single region
90 d
audit retention · 1 y on request
< 72 h
breach notification
Events processed · 24h
284,173
UGC posts · rights requests · widget impressions
AWS eu-west-2
London · single-region
99.95%
measured · status.idukki.io
Event tail · last 4
- TLS 1.3 ✓inbound · widget.js0s
- AES-256 ✓tenant 0x7a2 · put0.4s
- RBAC ✓rights.read · ok1.1s
- Audit ✓login · sso · okta1.6s
Posture · today
- Live
Encryption
TLS 1.3 · AES-256
- Live
SSO + RBAC
Okta · Azure · Google
- Live
Audit log
90 d · 1 y on req
- Live
Pen-test · annual
CREST · last May
- Roadmap
SOC 2
2026 roadmap
- Roadmap
ISO 27001 / PCI
2026 roadmap
Request rate · per s
The full posture
Six surfaces, every line annotated as live, in progress or on the roadmap. The DPA goes deeper on each row and is the procurement-ready version of this page.
Compliance posture
- Roadmap
SOC 2 Type I
Not yet started · targeted after a compliance-automation platform is selected
- Live
GDPR / UK GDPR
Self-attested · DPA available
- Live
CCPA · CPRA
Self-attested · DSAR workflow
- Live
India DPDP
Self-attested · data fiduciary
- Roadmap
ISO 27001
On the roadmap, not yet started
- Roadmap
PCI DSS
On the roadmap · we do not store PAN
Access + identity
- Live
TLS 1.3
Inbound + outbound · HSTS
- Live
AES-256 at rest
Database + object storage
- Live
SAML 2.0 SSO
Okta · Azure AD · Google Workspace
- Live
Role-based access
Owner / Admin / Editor / Viewer
- In prog
MFA
Enforced for internal systems today; company-wide rollout planned
Infrastructure
- Live
Region
AWS eu-west-2 · London
- Live
Edge + CDN
Vercel · Cloudflare
- Live
Secrets management
AWS Secrets Manager · KMS rotated
- Live
Backups
Daily snapshots · 30-day retention
- Roadmap
Multi-region failover
Roadmap · 2027
Data + retention
- Live
Tenant isolation
Per-tenant ID, row-level scoping
- Live
Audit log retention
90 days standard · 1 year on customer request
- Live
GDPR deletion SLA
30 days · documented in DPA
- Live
Sub-processors
Public list · email-notified change
- Live
Data export
Self-serve · JSON + CSV
Monitoring + assurance
- Live
Application monitoring
Sentry · OpenTelemetry · 24/7
- Live
Anomaly alerting
Auth + billing + rate-limit
- Roadmap
Penetration testing
Not yet engaged · planned as part of SOC 2 readiness
- Live
Vulnerability reports
security@idukki.io
- Live
On-call ack
< 15 min business / 30 min nights
Incident response
- Live
Public status page
status.idukki.io · uptime + incidents
- Live
Customer notification
72 hours of confirmed disclosure
- Live
DPA breach clauses
Contractually committed timelines
- Roadmap
DR drills
Not yet run · planned
Need the DPA, sub-processor list and security questionnaire?
We ship a single ZIP. DPA (with SCCs), sub-processor register, and a redline-friendly MSA. Request it once, route it through legal.
- DPA + SCCs
- Sub-processor register
- MSA redlines
One-click bundle
Request the DPA bundle
Sent within one UK business day. No sales call required.
Security review
Need our security pack or DPA?
Available under NDA in minutes: DPA, SIG-Lite + CAIQ pre-filled, pen-test summary and the SOC 2 audit progress note.
- No credit card
- Cancel anytime
- GDPR + SOC 2 (in audit)
