Security, privacy and how we operate.
What we do to protect data, control access and operate responsibly — and where to go if you find a problem.
What's actually in place today.
Data Protection
Handling and protection practices defined for customer and organisational data. A standard Data Processing Agreement and privacy notice are available on request. We do not claim compliance certifications we have not earned.
Tenant Isolation
Customer environments and data kept isolated from one another. Enforced at the query level within the Seraph CTI platform, not only in the interface — customer environments and data never share execution context.
Role-Based Access
Access scoped to what a role genuinely requires, not granted by default. Access is scoped by role and reviewed as team membership changes, so no account carries more access than its function requires.
MFA & SSO
Multi-factor authentication and single sign-on supported for account access. Multi-factor authentication is enforced for every account, and per-tenant SAML SSO is available for organisations that require it.
Auditability
Administrative and security-relevant activity is logged and reviewable. Administrative and security-relevant activity inside Seraph CTI is captured in hash-chained, exportable audit logs designed to resist tampering.
Responsible Disclosure
A defined channel exists for reporting security issues responsibly. Security researchers can report a suspected vulnerability through our contact form. We commit to acknowledging reports and working toward a resolution.
Found a security issue? Tell us.
We take vulnerability reports seriously. If you believe you've found a security issue in our website or platform, here's what happens after you report it.
Report
Send details of the suspected issue through our contact form, including steps to reproduce where possible.
Acknowledge
We aim to acknowledge new reports and begin an initial review.
Investigate
Our team investigates and works toward a fix, keeping you informed of progress.
Resolve
Once resolved, we follow up to confirm and, where appropriate, credit the reporter.
What we don't claim
We do not claim SOC 2, ISO 27001, or other third-party certifications we have not earned. This page describes controls and practices currently in place, not third-party audited compliance status.
Have a procurement or security questionnaire to work through?
Tell us what your team needs, and we'll work through it with you directly.