Your data, isolated from every other tenant.
Tenant isolation at the database level, encryption in transit and at rest, US-hosted, geo-redundant backups, audit log on every meaningful change.
What every tenant gets.
Tenant isolation
Every document carries a TenantId, and every query is scoped to it. Our own platform operators can't transact in your tenant at all — they get read-only oversight, and only after an audited, explicit switch into it.
Encryption
TLS 1.2+ on every connection. Data at rest is encrypted by Azure Cosmos DB using service-managed keys.
US hosting
Your tenant data is stored on Azure in US regions. For EU/UK customers, transfers to the US are covered by the EU‑US Data Privacy Framework and Standard Contractual Clauses.
Backups
Cosmos DB takes geo-redundant snapshots of the database every four hours, retained for three days and replicated to a second US region. Restoring is a database-level operation we request from Microsoft — not a self-service, per-tenant rollback.
Role-based access
Five roles (SuperAdmin, CompanyAdmin, Manager, Employee, Client), with policy-enforced authorization on every page and endpoint that touches tenant data. Public surfaces — sign-up, a shared invoice link — are the deliberate exceptions.
Audit log
Every state-changing event is captured with actor, timestamp, entity, action. Per-tenant. Retained for the life of your tenant.
What we have, what we don't have yet.
What we have today
- Tenant isolation enforced at the data layer — every query against your business data is scoped by TenantId. The exceptions are deliberate and narrow: public share links (a hosted invoice, an embedded contact form) resolve by an unguessable random token instead, and return only the one record that token names
- Azure Cosmos DB with TLS-only connections; Microsoft-managed encryption at rest
- Sign-in delegated to our identity provider (WorkOS) — we store no passwords; it enforces password policy, MFA, and breached-password checks
- Audit log of every meaningful state change, per tenant
- Data retention & deletion: a cancelled account's data is purged after the retention window — invoices are anonymized where tax law requires the record be kept
- Data-subject access & erasure: we can export or delete a person's data on request
- A defined breach-response process with a 72-hour authority-notification clock
- Hosted in US Azure regions; sub-processors are Azure (hosting, database, storage), WorkOS (sign-in), Stripe (subscription billing), Azure Communication Services (email), Application Insights (diagnostics), Cloudflare (bot defence on our public forms), and Google Fonts (web-font delivery)
What's roadmap (transparent: not yet)
- Point-in-time restore — our backups are snapshot-based today; continuous PITR is the next infrastructure change we're making
- SOC 2 Type II report — under evaluation, likely 2027
- Customer-managed encryption keys (BYOK) — Q4 2026
- SSO via SAML / OIDC — when we hit our first customer that asks for it
- HIPAA / FedRAMP — not on the roadmap; we're not the right fit if you need either
Reporting a vulnerability: email security@sbassistant.com. We respond to legitimate security reports within one business day.