The receipts your security team wants.
SOC 2 in audit, GDPR self-certified, CCPA, ISO 27001 on the roadmap, AWS eu-west-2 hosting. Everything procurement and security need is in one place. Current controls are shared under NDA.
Compliance + certifications
What is certified, what is self-assessed and what is still on the roadmap. Documents available under NDA.
SOC 2
In audit, not certified yet. Security pack, sub-processors and DPA available under NDA.
GDPR + CCPA
GDPR self-certified (no external certification claimed). Data hosted in AWS eu-west-2 (London). DPA signed by default.
ISO 27001
On the roadmap. Work has not started.
PCI-aware
No card data ever touches our systems, handled by Stripe + your gateway.
Cyber Essentials
UK Cyber Essentials on the certification roadmap for our public-sector customers.
Platform security
How we keep your data safe in transit, at rest and at the seams.
Sign-in + roles
Email and password or Google sign-in, with role-based access per user. SAML single sign-on and SCIM provisioning are not available yet.
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest.
AWS eu-west-2 (London)
Single-region hosting in eu-west-2 today. Multi-region failover is on the roadmap.
Audit trail
Changes Idukki staff make to your account are logged with who made them and when. Rights requests keep their own record per post.
Dependency scanning
Automated dependency scanning and update pull requests on every repository. No third-party penetration test yet; one is planned as part of SOC 2 readiness.
Incident response
Severity-1 acknowledgement under 1 hour during business hours. Written post-mortem to impacted customers within 5 business days.
Procurement-ready
Documents your legal + finance teams want before a kickoff.
Master Service Agreement
Standard MSA with redline-friendly clauses for global enterprises.
RequestData Processing Addendum
GDPR + UK GDPR + CCPA compliant DPA, with EU SCCs and UK IDTA.
RequestSub-processors list
Listed on our GDPR page. We give 30 days’ notice before a change.
View listVendor security questionnaire
CAIQ + SIG-Lite + custom questionnaires pre-filled. Average turn-around: 48 hours.
Request
Found a security issue? Tell us first.
Email security@idukki.io with steps to reproduce, the affected URL or endpoint, the impact and a proof of concept. We don’t run a paid bug bounty or a HackerOne or Bugcrowd programme; the full policy, scope and safe harbour are on the security page.
- Acknowledgement within 3 business days
- Status update within 10 business days
- Credit after the fix, if you want it
Security review
Need our security pack or DPA?
Available under NDA in minutes: DPA, SIG-Lite + CAIQ pre-filled and the SOC 2 audit progress note.
- No credit card
- Cancel anytime
- GDPR self-certified · SOC 2 (in audit)
