Security
Security built for the data presales teams hand over
A knowledge base carries more than answers. It holds the security posture, the compliance claims and the engineering decisions your company stands behind. SiftHub is built around that weight, not around convenience.
How the security programme is put together
SiftHub runs on AWS infrastructure in the United States. Controls are layered across network, platform, application and data rather than concentrated at one perimeter. Secure settings are the default; hardening is not left to the customer after onboarding.
Our own security programme is held to the standard we apply when answering a customer's questionnaire. When an enterprise prospect sends us one, we complete it in SiftHub from our internal knowledge base. That is a test of the product and a straight look at how we document security.
Responsibility divides along clear lines. AWS secures the physical and virtual infrastructure underneath. SiftHub secures the application, the data inside it and the controls customers operate.
Technical controls
Encryption in transit and at rest
Traffic is protected with TLS 1.2 or above, and stored data uses AES-256. That covers knowledge base documents, questionnaire drafts, approved answers and the metadata around them. Keys sit in AWS KMS and rotate on a fixed schedule.
Access and authentication controls
Role-based permissions are enforced at the account level, so an administrator decides what each user can see and change. MFA is available to every account and we encourage turning it on. Enterprise plans add SAML 2.0 and OIDC single sign-on, which brings your organisation's own authentication rules, from MFA requirements to session limits, into the login flow.
Data isolation and tenancy
Tenants are separated at both the application and data layers. Knowledge base content and questionnaire data never cross between customers, and no model is trained on your documents. Uploaded files stay inside your own environment. The separation logic is identical on every plan rather than an Enterprise add-on.
Logging and audit trail
Uploads, answer approvals, exports, new users and configuration changes each leave an audit entry. Logs cannot be edited, are kept for 12 months and can be exported by an account administrator. Enterprise plans add API access for SIEM integration.
Network security
Services run in private subnets inside AWS VPCs. Inbound requests pass a web application firewall and load balancers protected against DDoS. Internal service traffic is held to security group rules and never crosses the public internet. The perimeter is assessed for vulnerabilities on a recurring basis.
Backup and recovery
Backups run daily into an isolated, encrypted environment and are held for 30 days. Restores are tested regularly against documented recovery time objectives. When a failure touches customer data, the incident response team begins remediation within an hour of detection.
Compliance and day-to-day data handling
SiftHub is built for enterprise procurement rather than retrofitted for it. Engineering and operational practice line up with the controls buyers check at financial services, healthcare and technology companies, the sectors that send the most demanding questionnaires.
Data residency
Customer data is stored and processed in the United States and stays there unless a written agreement says otherwise. Enterprise procurement conversations can cover dedicated residency arrangements.
Data processing and privacy
Uploaded documents and questionnaire data are processed to deliver the service and nothing else. Customer data is never sold or licensed to a third party. Core infrastructure sub-processors such as AWS, along with transactional email providers, are listed in the Data Processing Addendum, which we provide on request during enterprise procurement.
Employee access to customer data
Routine access to customer knowledge bases or questionnaire data does not happen. Any access needs approval from engineering leadership, is logged, expires on a timer and is revoked automatically once the stated purpose is served. Staff who may enter customer data environments go through background checks.
Incident response
Where a security incident touches customer data, affected customers hear from us within 72 hours of confirmed detection, in line with applicable data protection requirements. The notice covers what happened, which data was involved and what we did about it.
In the middle of a security review?
Enterprise buyers usually need more than a web page. Send over your security questionnaire and we will return a completed draft within two business days. Anything left open can be worked through on a call with the people who built the system.
Start the Review