Assenture

Security policy

Last updated: June 17, 2026

Assenture is built for finance and operations teams who need to trust that their data is safe. This page describes the controls we have in place. Nothing below should be read as a guarantee that an incident will never happen; it is a description of how we work to prevent them and how we respond if one does.

Infrastructure

  • Application served from Cloudflare's global edge network with automatic TLS 1.3.
  • Primary database and storage hosted on managed Postgres in the European Union, with point-in-time recovery and daily encrypted backups retained for 30 days.
  • All network traffic to our backend is encrypted in transit. Data is encrypted at rest using AES-256.

Authentication and access

  • Customer logins use email and password (with bcrypt hashing handled by our auth provider) or Google OAuth. Passwords are never stored in plaintext or accessible to staff.
  • Row level security policies enforce that every customer can only read or write their own data. The same policies apply to staff using the Service.
  • Internal access to production data is restricted to a small number of named engineers, requires SSO with hardware-key multi-factor authentication, and is logged.
  • The principle of least privilege is the default. Service accounts and API keys are scoped to specific tasks and rotated regularly.

Application security

  • All inputs are validated server side. We use parameterised queries throughout and never interpolate user input into SQL.
  • Output is escaped by the framework; we forbid dangerouslySetInnerHTML with user content.
  • Dependencies are scanned for known vulnerabilities on every build, with security patches prioritised.
  • Authenticated routes are protected by middleware. Public API endpoints validate signatures or shared secrets before performing any action.

Secrets management

  • All API keys, signing secrets, and database credentials are stored in an encrypted secret store, scoped per environment, and injected at runtime. They never appear in source control.
  • Customer-provided integration credentials are encrypted at rest with a key separate from the application database.

Logging and monitoring

  • Application errors are captured by our monitoring tooling with stack traces and minimal user context (hashed user ID, route, browser).
  • Authentication events, role changes, and administrative actions are recorded in an immutable audit log accessible to admins of each workspace.
  • We alert on unusual patterns such as repeated failed logins, sudden export volumes, or unexpected privilege escalations.

Backups and disaster recovery

  • Daily full backups plus continuous write-ahead log archiving. RPO target: 5 minutes. RTO target: 4 hours.
  • Restoration is rehearsed at least twice per year against a clean environment.

Incident response

If we become aware of a confirmed personal data breach affecting your data we will notify affected customers without undue delay, and in any case within 72 hours of confirmation, with the information required by Article 33 GDPR (nature of the breach, categories and approximate numbers affected, likely consequences, and measures taken or proposed).

Responsible disclosure

We welcome security research. If you believe you have found a vulnerability, please email business@assenture.app with a clear description and reproduction steps. We commit to acknowledging within 2 business days, keeping you informed of remediation, and not pursuing legal action against good-faith researchers who:

  • Do not access, modify, or download data that is not their own.
  • Do not degrade the Service or disrupt other users.
  • Give us reasonable time to remediate before public disclosure.
  • Do not engage in extortion or demand payment as a condition of disclosure.

Compliance posture

Assenture operates in alignment with GDPR (EU), UK GDPR, the California Consumer Privacy Act (as amended by CPRA), and Singapore's PDPA. We are not currently SOC 2 or ISO 27001 certified; an active roadmap towards SOC 2 Type II is in progress. We will publish the attestation report under NDA once available.