Security

1. Hosting

All production workloads run on Microsoft Azure in the EU West region. No customer data leaves the European Union.

Infrastructure is provisioned via reproducible templates from a tagged commit; we can rebuild any historical production version from source.

2. Tenant isolation

Each customer is provisioned with a dedicated Cosmos DB container, blob path and search index. No cross-tenant query path exists in the application code.

Identity is enforced by Microsoft Entra ID with our own per-customer routing logic on top — every request is bound to a tenant context before any data access happens.

3. Encryption

TLS 1.2+ in transit. AES-256 at rest by default for Azure Storage and Cosmos DB. Backup data inherits the same encryption guarantees.

4. Access control

Application identities use Azure managed identity where possible. No long-lived secrets in source code; Key Vault is the source of truth in production.

Soratus support has read access to customer data only when explicitly invoked through the documented support-mode flow, with audit logging on every action.

5. Authentication

Customer login is via Microsoft Entra ID (work accounts) and Microsoft Entra External ID (B2B-style invitations).

Multi-factor authentication is enforced at the customer's tenant level — Umbiko does not store credentials. Tokens are short-lived and refreshed automatically.

6. AI and customer data

Customer Content is never used to train, fine-tune or evaluate AI models — yours stays yours.

Inference happens on Azure-hosted OpenAI deployments in the EU; prompts and completions are not retained beyond what is needed to render the response and our own audit log.

7. Logging and monitoring

Authentication events, status changes on customer records and admin overrides are logged with actor and timestamp.

Application telemetry runs through Azure Application Insights. Logs are retained for the period required to investigate incidents and then expire automatically.

8. Vulnerability management

Dependencies are scanned on every CI run; security advisories are reviewed within one business day.

Operating-system images are auto-patched on the Azure platform side; container base images are rebuilt at least monthly.

Annual third-party penetration test, with remediation tracked publicly in our roadmap.

9. Compliance roadmap

GDPR — implemented (see Privacy Policy + DPA).

SOC 2 Type II — in progress, target late 2026.

ISO 27001 — under evaluation for 2027.

10. Reporting a vulnerability

We welcome responsible disclosure. Email security@umbiko.ai with a description of the issue, reproduction steps and your contact information.

We acknowledge within one business day, validate within five, and credit reporters in our security hall of fame on request.