Security

We implement a comprehensive, multi-layered security architecture to protect our platform, customer data, and infrastructure. Key elements include:

• Cloud Infrastructure: Hosted entirely on Microsoft Azure, leveraging enterprise-grade physical and network security.

• Encryption: All data is encrypted in transit using TLS 1.2 and at rest using AES-256. API credentials are stored securely in Azure Key Vault.

• Application Gateway Security: Azure Application Gateway provides protection via a Web Application Firewall (WAF) with the OWASP Core Rule Set, IP whitelisting, DDoS mitigation, HTTP/2 support, logging, session management, and diagnostics.

• Platform Security Features:
  Input sanitisation and automatic rejection of malformed inputs
  reCAPTCHA for bot prevention
  Secure CORS policies and HTTP headers configured via FastAPI

• Access Controls: Multi-factor authentication (2FA) is enabled for the Azure Console, with least-privilege access control policies applied across the platform.

• Monitoring & Threat Detection:
  Microsoft Defender for Cloud offers unified security management, threat detection, and integrated vulnerability scanning.
  Azure Monitor, Sentinel (SIEM), Application Insights, and Log Analytics provide real-time alerts, diagnostics, and automated incident response.

• Data Protection: Regular Azure File Share backups with point-in-time restore capabilities ensure data integrity and disaster recovery.

• User Awareness: Every team member receives personalised onboarding with security training to promote a strong security culture.

• Physical Security: Our cloud-hosted infrastructure benefits from Azure’s world-class data centre protections, including biometric access, surveillance, and compliance with industry certifications.

• Continuous Improvement: We regularly audit and enhance our security practices to stay ahead of evolving threats.

• Third-Party Risk Management: While we do not currently use third-party vendors with access to our systems, we have strict evaluation and compliance procedures in place should that change.