Security
Security built into the platform.
Encryption at rest and in transit, AWS hosting with daily backups, and fine-grained access. Then how we work safely in your environment.
Identity provider
Example- ReadRead-only
- UsersGroupsSign-in logs
- Write
- None
Your cyber expert agrees the real list with you at kickoff.
Platform security
Protected at every layer of the platform.
From encryption to access controls, we embed security and privacy protections throughout.
Application and infrastructure security
Role-based access, encryption in transit and at rest, and separate storage for each customer.
Data encryption
All data is encrypted at rest with AES-256 and in transit using TLS.
SOC 2 compliant
Our platform and infrastructure are SOC 2 compliant.
ISO 27001 certified
Our information security management is ISO 27001 certified.
Access security
Fine-grained permissions for different user roles and responsibilities.
Reliability you can depend on
Hosted for continuity, with defenses and recovery built in.
Hosted on Amazon Web Services
Hosted across multiple AWS availability zones with auto-scaling and redundancy.
99.9% uptime commitment
We prioritize uptime and infrastructure stability across the platform.
DDoS and threat mitigation
Built-in defenses combined with Cloudflare protect against distributed denial-of-service attacks.
Database mirroring and recovery
Built-in mirroring supports continuity and data resilience.
Daily, regional backups
Automatic daily backups with multi-region recovery support.
Privacy by design
Privacy controls are part of the platform, not an add-on.
GDPR compliance
Privacy controls built to meet GDPR requirements.
Granular privacy controls
Control who sees what, down to the role.
Data isolation
Customer data is kept separate.
No AI training on your data
Our Master Subscription Agreement states that we will not use Customer Data to train or fine-tune AI or machine learning models.
In your environment
Four ground rules for every program.
Read-only by default
We connect read-only to the identity, endpoint, cloud and SIEM tools you already run. Nothing to install, nothing changed.
Only the access the work needs
Your cyber expert confirms the exact tools and access at kickoff. If we cannot do the work without a permission, we ask for that permission and nothing wider.
Ownership first
We confirm you own a domain before we run any scan or posture check on it, including for the free risk check. Breached accounts are reported as counts only, never passwords.
Experts review what matters
VectraIQ drafts, scores and monitors. Your named lead expert reviews final reports and makes the key decisions with you.
What we need from you
Access you grant, and who approves it.
You stay in control of what we can see. Your cyber expert agrees the list with you at kickoff.
Read-only access to the tools in scope
Typically identity, endpoint, cloud and SIEM tools. Your cyber expert confirms the exact list at kickoff.
Confirmation that you own the domain
Needed before any scan of your domain, including the free risk check.
Approval from whoever administers each tool
Access is granted from your side, in your tools, by the person who owns them. You decide what to connect.
Optional: wider access for hands-on fixes
Only where you choose to grant it, our Cybersecurity Engineers can make a change directly in the tool instead of handing you a ticket. This is the advanced remediation support, not part of the standard connection.
Questions, answered.
How is AI used, and is my data safe?
VectraIQ drafts, scores and monitors. Your cyber expert reviews final reports and makes the key decisions with you. Our Master Subscription Agreement states that we do not use Customer Data to train or fine-tune AI or machine learning models. Ask us how we handle your data.
Which tools do you connect to, and what access do you need?
We connect read-only to your identity, endpoint, cloud and SIEM tools. Your cyber expert confirms the exact list and the access needed at kickoff, and the person who administers each tool approves it.
Will you scan my domain without asking?
No. We confirm you own the domain before we run any scan or posture check, including the free risk check.
Can you change settings in our tools?
Connections are read-only by default. Where you choose to grant additional access, our Cybersecurity Engineers can make a change directly in the tool as advanced remediation support.
Can you answer our security questionnaire?
Tell us what your security review covers through the contact form and we will take it from there.
Questions about security?
Tell us what your security review covers and a lead expert will respond on each point.