Security architecture
What svdy actually does to protect your data, today. No certification claims we haven't earned. Live SOC 2 timeline at /trust/soc2; full sub-processor list at /trust/sub-processors.
Infrastructure security
Concrete controls operating in production:
• AWS Multi-AZ deployment in us-east-1 — RDS Postgres with synchronous replication, ECS Fargate across multiple Availability Zones, S3 with cross-AZ replication. Architectural target: 99.95% uptime.
• Encryption in transit: TLS 1.2+ on every public endpoint (svdy.com / qutime.com / pureoa.com / id.svdy.com / api.svdy.com), with HSTS preload eligibility and modern cipher suites only. Internal service-to-service traffic also TLS-only.
• Encryption at rest: AES-256 on RDS, S3, and EBS volumes; managed via AWS KMS keys with audited access. Customer-encrypted secrets (OAuth tokens, integration webhook URLs) use Fernet (AES-128-CBC + HMAC-SHA256) on top of disk encryption.
• Network isolation: no public RDS / Redis endpoints — application servers reach databases through VPC private subnets and Security Group rules; bastion access is JIT-only with audit logging.
• Secrets management: production credentials live in AWS Secrets Manager, never in source code or environment files. Rotation runbooks documented; key rotation is a Phase 2 SOC 2 milestone.
Data protection
What happens to your data, end-to-end:
• Multi-tenant isolation: every database query is scoped by organization_id at the ORM layer; integration tests verify cross-tenant queries return no rows. No raw SQL access for application code.
• Audit logging: every admin mutation (create / update / delete worker, schedule, attendance entry, billing change) is recorded with actor, target, before/after values, IP address, and timestamp. Retention is plan-tier-dependent: 7 days (Free) / 1 year (Starter+) / 3 years (Pro+).
• Backups: RDS automated snapshots daily, retained 30 days; point-in-time recovery to any second within the retention window. Restores are tested quarterly per disaster-recovery runbook.
• Right-to-erasure flow: GDPR / CCPA deletion requests flow through /admin/identity/users — anonymizes worker PII (name, email, phone, biometric template) while preserving aggregated attendance records the controller (your organization) needs for labor-law compliance. See Privacy Policy §4 for the full mechanism.
• Biometric data (face recognition for clock-in): collected only when a worker explicitly consents at first use (GDPR Art. 9(2)(a)). Face templates are stored as one-way hashes — the original image is never retained. Org admins can disable face recognition globally in Attendance Rules; consent can be withdrawn anytime in worker profile.
Operational security
How we run security as a function:
• Engineering practice: every code change goes through pull-request review with at least one approving reviewer. Security-relevant changes (auth, encryption, IAM) require an additional security-designated reviewer.
• Dependency management: Python via Poetry with locked versions; JavaScript via Bun lockfile. Vulnerable dependencies surfaced via GitHub Dependabot and addressed in priority order.
• Access control: production access is read-only by default; write access requires a documented change ticket. Engineer offboarding revokes all access within 24 hours of departure.
• Incident response: an internal runbook covers identification → containment → eradication → recovery → post-incident review. Severity-1 incidents trigger a 24-hour customer notification commitment (Privacy Policy §6).
• Vendor security review: every sub-processor we add (currently 5 listed at /trust/sub-processors) goes through a documented review — DPA in place, security questionnaire reviewed, data scope minimized.
Certifications and attestations
We commit to a public, dated roadmap rather than retroactive claims. Live progress:
• SOC 2 Type II — TARGETED Q1 2027. Not yet certified. Vanta + A-LIGN selected (decision logged 2026-05-24). Public 8-milestone timeline at /trust/soc2; report issued Q3 2027.
• GDPR-ready architecture — privacy audit Wave 1-4 complete (data minimization, right to erasure, consent gates, biometric processing under Art. 9). Not formally certified by a regulator (GDPR has no formal certification body); we provide our DPA on request at /trust/dpa.
• ISO 27001 — NOT YET ENGAGED. May follow SOC 2 in 2027 or 2028 depending on customer demand from EU enterprise prospects.
• Industry-specific (HIPAA / PCI-DSS / FedRAMP) — NOT IN SCOPE today. svdy targets SMB workforce management; healthcare PHI / cardholder data / federal-government workloads are out of our use case until explicitly added.
Need to fill out a security questionnaire, run a vendor due-diligence review, or report a vulnerability? Email security@svdy.com — we acknowledge within 1 business day and respond within 3.