How we protect an engagement's data.

This page is maintained by Alignd to answer the questions procurement asks first. It describes controls that are in place today. It is not a certification and not an independent audit.

• EncryptionTLS 1.2+ in transit; AES-256 at rest on the managed database and its backups.
• HostingManaged PostgreSQL in an EU region, run by our infrastructure provider with patching and monitoring included.
• Access modelRow-level security in the database: a row is only readable by members of that engagement. There is no cross-engagement view.
• Individual answersThe weekly pulse (coming in the pilot) is designed so individual answers are never shown to either side and only per-side aggregates are returned to the application. Today each side logs shared signals directly.
• ImmutabilityLocked weeks are coming in the pilot: once a week closes it will be locked, and historic scores and evidence cannot be rewritten. Today signals can be edited by either side at any time.
• AuthenticationEmail and Google sign-in via a managed identity provider. No shared logins. No anonymous sign-ups.
• BackupsAutomated daily backups with point-in-time recovery, retained 7 days, encrypted and stored in the EU.
• Internal accessLimited to the people who operate the service, only when needed to fix a fault, and never to read individual pulse answers.

The demo versus the product

The demo on this website runs entirely in your browser: what you type in /onboarding or /dashboard stays in your browser's local storage and is never transmitted to us. The real product is different — it stores your engagement's data in the EU-hosted, encrypted database described above.

Shared responsibility

We are responsible for the application, the database configuration, encryption, access controls, backups and keeping dependencies patched.

You are responsible for who you invite into an engagement, removing people when they leave the project, keeping accounts secure, and not putting special-category personal data into pulse comments.

Data handling

Retention, sub-processors and deletion timelines are set out in the privacy policy. Written data-processing terms are issued at pilot start; ask us for the current version and we will send it the same day.

Reporting a problem

If you believe you have found a vulnerability, or you need to reach us about a security incident, email vasco.ammo92@gmail.com with "SECURITY" in the subject. We acknowledge within one working day. If an incident affects your engagement data, we will tell you what happened, what data was involved and what we did about it — without waiting for a full investigation to close.