Trust & Security
Our customers are security and intelligence teams. They assess vendors for a living, so this page is written to be assessed — specific where we can be, and explicit about what we have not done yet.
Where your data is held
Everything runs in the EU. Hosting is with a Swedish provider, and the two other services we rely on are French. We do not transfer personal data outside the EU/EEA.
The full list of third parties, what each one handles and where it operates, is published at Sub-processors. We give 30 days’ notice before that list changes.
How customers are separated
Customers share the platform’s infrastructure, and separation is enforced in the application rather than by giving each customer its own machine. We say that plainly because it is the question a security team should ask, and an answer that overstates it is worth nothing to you.
Inside the application, every customer-visible record carries an owning organisation and every query is scoped to it, with visibility denied by default rather than granted by default. That rule is enforced by automated tests that fail the build if a query is written without the scope, so it holds as the code changes rather than only on the day it was written.
A dedicated, isolated deployment is available — separate database, separate message broker, separate application instance — where a customer’s own obligations require it. It is a priced option rather than the default, because it costs real money to run. Ask us.
Access and authentication
- Passkeys (WebAuthn) and multi-factor authentication are supported for user accounts.
- Permissions are role-based and scoped to the organisation, on a least-privilege basis.
- Administrative access to production is restricted to authorised personnel over an encrypted private network, using key-based authentication.
- Security-relevant events are recorded.
Encryption
- Traffic to the platform is encrypted with TLS.
- Traffic between our own hosts travels over an encrypted overlay network.
- Credentials and secrets are held in an encrypted store, not in configuration files.
Backups and recovery
Databases are backed up daily under a documented retention schedule. Restores are verified automatically and regularly by loading a recent backup into an isolated environment and checking it — because an unverified backup is a file you hope is good.
Deployments are automated from a versioned source, with a health check and automatic rollback if it fails.
How we build
The platform carries an automated test suite of roughly 17,000 tests, run against real infrastructure rather than mocks alone. Architectural rules — the separation between customers, the boundary between application layers, the shape of the permission model — are enforced by tests that fail when a change would erode them.
Changes affecting authorisation or customer separation receive additional review before release.
AI processing
Automated analysis is performed by a language-model provider established in France. Neither your content nor your output is used to train or fine-tune any model, and the provider’s terms prohibit the same.
Analytical output is decision support, not verified fact. The platform shows the source behind each finding and distinguishes what was stated directly from what was inferred, so that an analyst can check it. We expect output to be reviewed before it is relied on or published.
Certifications — where we actually are
ELEVATE is not certified to ISO 27001. We are building the management system with certification as the goal, and we would rather say so plainly than imply a status we do not hold.
We comply with the GDPR, act as processor under a Data Processing Agreement that customers receive as a schedule to their contract, and maintain the assessments that our lawful basis depends on. Both are available for review.
Reporting a security issue
If you believe you have found a vulnerability, email security@elevate-platform.eu with enough detail to reproduce it. We will acknowledge within two business days and keep you informed while we fix it. The same address is published at /.well-known/security.txt.
We will not pursue legal action against anyone who reports an issue in good faith, who stays within the scope of their own account, and who gives us reasonable time to respond before disclosing. We do not currently run a paid bounty.
What you can ask us for
- Our Data Processing Agreement.
- The assessment underpinning our lawful basis for processing published source material.
- Answers to your own security questionnaire — if something you need is not covered here, ask and we will add it.
Contact privacy@elevate-platform.eu for data protection, or support@elevate-platform.eu for anything else. See also our privacy notice and terms.