Data Security & Encryption Standards

1. Encryption in Transit and at Rest

Ironclad employs bank-grade encryption to protect sensitive corporate and personal identifiers:

• In Transit: All communication between your browser and our servers is encrypted using TLS 1.3 and TLS 1.2 with robust cipher suites. Direct database connections require secure SSL handshakes.
• At Rest: All files uploaded to our Document Vault are encrypted using AES-256 before being written to disk. The underlying database volumes on Supabase are encrypted at rest using industry-standard keys.

2. Database Security & Tenant Isolation

Our PostgreSQL database runs on Supabase (hosted in the AWS Mumbai region). We enforce a strict Tenant Isolation Model:

• Row Level Security (RLS): RLS is enabled on all tables (Jobs, Tasks, Documents, Partners). A customer can only access rows linked to their specific Business ID.
• Role-based Access Control (RBAC): Access to APIs and pages is checked server-side and in the routing middleware. Even if an endpoint is exposed, it rejects unauthorized roles (e.g. preventing Partners from accessing Admin audit logs).

3. Infrastructure & Network Protections

The Platform is deployed globally using Vercel Serverless Edge, which filters traffic through Ddos mitigation and rate-limiting filters.

Database access is isolated. External network connection ports are tightly controlled, with direct SQL queries restricted. Our connection poolers manage active connections safely to avoid resource starvation.

4. Detailed Audit Trail

To meet strict compliance audit requirements, Ironclad maintains an immutable, write-only Audit Log for all sensitive operations (such as Sign In, Invite Member, Upload Document, and Document Verification).

Each audit log captures the Actor ID, Action, Timestamp, IP address, and User-Agent details, and is retained for a minimum of 7 years.