The receipts your security team wants.
SOC 2 in audit, GDPR self-certified, CCPA, ISO-aligned, AWS eu-west-2 hosting. Everything procurement and security need in one place, current controls + sub-processors downloadable under NDA in minutes, not weeks.
Compliance + certifications
What is certified, what is self-assessed and what is still on the roadmap. Documents available under NDA.
SOC 2
In audit, not certified yet. Security pack, sub-processors and DPA available under NDA.
GDPR + CCPA
GDPR self-certified (no external certification claimed). Data hosted in AWS eu-west-2 (London). DPA signed by default.
ISO 27001 aligned
ISMS controls modelled on ISO 27001:2022. Certification on roadmap H2.
PCI-aware
No card data ever touches our systems, handled by Stripe + your gateway.
HIPAA-ready (BAA)
BAA available for healthcare brands on Enterprise plans.
Cyber Essentials
UK Cyber Essentials on the certification roadmap for our public-sector customers.
Platform security
How we keep your data safe in transit, at rest and at the seams.
Sign-in + roles
Email and password or Google sign-in, with role-based access per user. SAML single sign-on and SCIM provisioning are not available yet.
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest.
AWS eu-west-2 (London)
Single-region hosting in eu-west-2 today. Multi-region failover is on the roadmap.
Audit trail
Changes Idukki staff make to your account are logged with who made them and when. Rights requests keep their own record per post.
Dependency scanning
Automated dependency scanning and update pull requests on every repository. No third-party penetration test yet; one is planned as part of SOC 2 readiness.
Incident response
Severity-1 acknowledgement under 1 hour during business hours. Written post-mortem to impacted customers within 5 business days.
Procurement-ready
Documents your legal + finance teams want before a kickoff.
Master Service Agreement
Standard MSA with redline-friendly clauses for global enterprises.
RequestData Processing Addendum
GDPR + UK GDPR + CCPA compliant DPA, with EU SCCs and UK IDTA.
RequestSub-processors list
Live list at /trust/subprocessors with 30-day change notification email.
RequestVendor security questionnaire
CAIQ + SIG-Lite + custom questionnaires pre-filled. Average turn-around: 48 hours.
RequestInsurance
$10M cyber liability + $5M E&O. Certificates on request.
Request
Found a security issue? Tell us first.
Email security@idukki.io with steps to reproduce, the affected URL or endpoint, the impact and a proof of concept. We don’t run a paid bug bounty or a HackerOne or Bugcrowd programme; the full policy, scope and safe harbour are on the security page.
- Acknowledgement within 3 business days
- Status update within 10 business days
- Credit after the fix, if you want it
Security review
Need our security pack or DPA?
Available under NDA in minutes: DPA, SIG-Lite + CAIQ pre-filled and the SOC 2 audit progress note.
- No credit card
- Cancel anytime
- GDPR self-certified · SOC 2 (in audit)
