Security and trust

We sell to CISOs.
Here's our own posture.

You manage sensitive compliance, risk and governance data in this platform, so this page describes the controls as they are. No vague badges, no claims we can't demonstrate in a live session.

Platform status page Platform changelog

Tenant isolation

  • Per-tenant isolation enforced in the database with row-level security
  • Isolation is a platform boundary, not a UI setting
  • Auditor-portal redaction keeps shared evidence scoped

Authentication and access

  • MFA
  • SSO via OIDC/SAML
  • SCIM provisioning
  • LDAP

Audit and visibility

  • Audit logs record actions in the workspace
  • AI actions are metered and visible to the customer
  • A published security findings register is kept by the engineering team
  • A public status page communicates availability

Data protection

  • Encrypted sensitive fields
  • Data hosted in India
  • No customer data is used to train AI models

Governed AI

  • Anthropic Claude for generation and OpenAI for embeddings — named and disclosed
  • No customer data is used to train models
  • Every AI action is metered and visible to the customer

Evidence integrity

  • Evidence stays linked to the controls it proves
  • Evidence shared with auditors is scoped and redactable

Data hosted in India

The standard platform keeps customer data in India.

How Sage AI works

We publish the AI plumbing: Anthropic Claude for generation, OpenAI for embeddings, no training on customer data, and every AI action metered and visible.

Read the AI transparency page

Planned — no dates

We would rather label planned work than pretend it shipped. Ask us about any of these in your demo.

  • Program-centric workspaces — Planned — no date
  • Migration coach for existing policies and evidence — Planned — no date
  • Programme completeness scoring with remediation tasks — Planned — no date
  • More standards on request; HITRUST available once authorised by HITRUST — Planned — no date

Our security commitment

We run the platform with the controls above and publish a security findings register kept by the engineering team. We do not claim SOC 2 or ISO certification for Compliance Enablers itself; where a standard is licensed, the platform works alongside your own licensed copy and never redistributes standard text.

Want to see any of this live? The platform's Trust Center, audit logs, tenant isolation and metered AI are part of the standard demo. Book a demo.

For security questions or vulnerability reports, contact security@complianceenablers.com.