Identity & access
Least-privilege scopes, MFA enforcement, and role-based access controls.
Role-based access controls Access tokens expire after 60 minutes Admin MFA enforcement
Security & data protection
Security controls and US data residency.
MFA, encrypted pipelines, retention and deletion on request, and the current AWS us-east-1 data plane, with EU and APAC expansion on the roadmap.
- SOC 2 status
- Not certified. Ask about current audit status and the evidence available.
- AES-256 + TLS 1.2+
- Encryption at rest and in transit with KMS rotation.
- US data residency
- Production data hosted in AWS us-east-1. Regional expansion on roadmap.
- Audit records
- Ask which audit records, retention windows, and export formats are currently available.
How it works
Protection flow
-
Identity
MFA enforcement, short-lived access tokens, and role-based access controls.
-
Network
Private VPC, WAF, DDoS protections, and least-privilege service networking.
-
Data
AES-256 at rest, TLS 1.2+ in transit, production data in AWS us-east-1.
-
Audit
Confirm audit-record coverage, retention, and available export formats.
Security controls
Six pillars protecting your data
Identity, network, encryption, residency, retention, and auditability work together to keep review data safe and compliant.
Data protection
TLS 1.2+ in transit and AES-256 at rest, with encryption keys managed and rotated by AWS.
AES-256 encryption at rest and TLS 1.2+ in transit Per-tenant data isolation VPC-isolated Lambda functions
Network security
Private VPC per environment, WAF, DDoS protections, least-privilege ingress, and segmented service networking.
WAF with rate limiting DDoS mitigation at edge Network segmentation
Residency & isolation
US-based infrastructure with per-tenant isolation. Regional expansion is on the roadmap.
Encrypted backups Regional options on roadmap
Retention & deletion
Email privacy@tritonium.com to request deletion or a legal hold. The privacy policy sets response times, deletion deadlines, and retention exceptions. Confirm the request scope and available completion records.
Identity verification required Scope and timing follow published privacy terms Completion records subject to availability
Auditability & response
Ask which audit records, incident notifications, and exports are currently verified and available for your scope.
Confirm available audit records Confirm incident-notification coverage Confirm export format and retention
Data residency
US residency today, roadmap regions next
Production data is hosted in AWS us-east-1 and encrypted at rest. EU and APAC residency are on the roadmap.
-
US residency (current)
Production workloads hosted in AWS us-east-1 VPC-isolated infrastructure DPA available on request
-
EU residency (roadmap)
Not available yet Data-processing terms and privacy contact Email us if you need it
-
APAC residency (roadmap)
Not available yet Email us about your requirements Priority based on customer demand
Operational safeguards
Built-in rigor from detection to response
Operational playbooks, anomaly monitoring, and customer controls keep review data safe day-to-day.
Operational rigor
Runbooks, change management, and automated monitoring to keep review pipelines healthy.
Named responder with best-effort SLOs Change reviews for every release Playbooks for ingestion, storage, and delivery
Detection & response
Alarms for errors and access spikes, and rate limits that block request floods.
Anomaly alerts on ingress volume Alarms on sign-in failure spikes Rate limits that block request floods
Customer controls
You decide who on your team sees data. Retention, deletion and residency are handled by our team. Production runs in AWS us-east-1.
Role-based controls (owner/admin/member) Ask which audit records and export formats are available PII redaction and minimization
Security documentation
Documentation and current evidence
Read published terms and request current evidence. Scope and availability must be confirmed.
-
Not verified
SOC 2
Not certified. Ask about current audit status and the evidence available.
-
View terms
DPA & transfer terms
Read our data processing terms and listed subprocessors. Contact us about applicable data transfer terms.
-
Not verified
Penetration testing
Confirm the date, scope, findings and remediation status of any independent security testing. Report availability is not verified.
-
Not verified
ISO 27001
Certification status is not verified here. Request current scope and evidence before relying on an ISO 27001 claim.
Need a security review?
Request information for your security review. Confirm which documents and independent evidence are available.
Current audit status and evidence Independent test scope and dates Data flows and hosting locations Encryption and key management Processing terms and subprocessors Available operational documentation
Confirm document availability and response timing with us.