Security you can verify, not just take our word for.
BlueTower is a governance, risk, and compliance platform. This page explains how we protect the data our customers trust us with, and where we stand on SOC 2, ISO 27001, and GDPR.
Where we stand
We report status honestly. We are not certified yet, and we do not show badges we have not earned.
SOC 2 Type II
Full internal gap assessment complete against the Trust Services Criteria. Remediation is underway. Independent audit not yet started.
ISO/IEC 27001
Statement of Applicability drafted across all 93 Annex A controls. Certification audit not yet started.
GDPR
Data processing agreement, subject-request tooling, records of processing, and subprocessor transparency are in place and maintained.
Security controls
Every item below reflects a control that is live in the product today.
Access and authentication
- MFA required for privileged roles
- TOTP secrets encrypted at rest
- Passwords and backup codes hashed with bcrypt
- Automatic lockout on repeated failures
- Single sign-on via SAML and OIDC
Encryption
- AES-256-GCM for secrets at rest
- TLS 1.2 or higher in transit
- Encrypted database storage and backups
Monitoring and audit
- Tamper-evident audit logs with integrity hashes
- Real-time security event alerting
- Login, lockout, and access telemetry retained for review
Data and privacy
- Self-service data export and erasure
- Retention limits with scheduled purge
- Documented records of processing
- Public privacy notice
AI governance
- A person reviews and approves every AI suggestion
- Personal identifiers redacted before text reaches an AI provider
- Providers bound not to train on customer data
Infrastructure and resilience
- Least-privilege access
- Uploads scanned for malware, blocked if the scan cannot finish
- Row-level security on tenant data
- Documented backup and recovery
Subprocessors
The providers that help us run the service, and what each one handles.
| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Supabase | Database and file storage | Tenant data, uploaded files | United States |
| Vercel | Application hosting | Request metadata | United States |
| Anthropic (Claude) | AI analysis of SOC reports | Redacted document text | United States |
| Google (Gemini) | AI analysis of SOC reports | Redacted document text | United States |
| Resend | Transactional email | Name, email address | United States |
| VirusTotal | Malware hash lookup | File hash only | United States |
The full list with transfer mechanisms is in the documents below.
Policies and reports
Public documents are available now. Our internal policy set and audit artifacts are maintained internally and shared with customers and auditors under NDA as part of a security review.
Publicly available
Available to customers and auditors under NDA
Our full governance set is provided under NDA and scoped to your engagement. Some artifacts, such as the risk register and full Statement of Applicability, are limited to auditors.
Need something for your review?
Request our policy set, ask a security question, or start a vendor assessment. We usually reply within two business days.