Security built in.
Not bolted on.

Plain-language security posture for Keystone. Every control we run, encryption, tenant isolation, MFA, audit trails, bot protection, listed in one place so procurement teams don't have to guess.

1. Hosting & data residency

LIVEProduction data is hosted in AWS Ireland (eu-west-1, Dublin). No customer data leaves the EU without prior written consent (and we've never asked).

Each Keystone tenant runs in a logically isolated MongoDB database under a single regional cluster. Cross-tenant queries are impossible at the application layer (every query carries a `tenant_id` predicate enforced server-side; see audit-log section below).

LIVECloud or on-premise, your call. Keystone deploys on AWS EU infrastructure as standard, or as a local on-premise installation on your own servers where company policy, retailer contracts or data-sovereignty requirements demand it. Same product, same audit trail, your infrastructure.

2. Encryption

• LIVEAt rest: AES-256 via AWS KMS-managed keys. Backups encrypted with the same key hierarchy.
• LIVEIn transit: TLS 1.3 enforced on all public endpoints. HSTS preload-eligible. No TLS 1.0 / 1.1 fallback.
• LIVEField-level: Sensitive PII fields (customer delivery addresses, contact phones, supplier banking metadata) are encrypted application-side before reaching MongoDB.

3. Access controls

• LIVEPer-tenant role-based access with least-privilege defaults (super_admin · admin · ops_user · viewer · demo).
• LIVEIndustry-standard salted password hashing with timing-safe verification.
• LIVEMulti-factor authentication for every user, TOTP-based MFA available across all roles, not just admins.
• LIVESigned, short-lived session tokens with idle expiry and per-deployment secrets.
• LIVEAPI rate limiting on all public and authenticated endpoints.
• LIVEFailed-login throttling and brute-force IP lockout on all authentication endpoints.
• LIVEreCAPTCHA bot protection on public-facing forms, signups, contact and login flows are shielded from automated abuse.

4. Audit trail

LIVEEvery state-changing API call is recorded into an immutable audit log: actor, tenant, action, resource, before/after delta, timestamp, source IP. The log is queryable from the Admin Console and exportable as signed PDF, this is what BRCGS traceability requirements evidence looks like in practice. Status transitions on Traceability Events maintain their own status-history sub-log on top.

5. Compliance & standards

• LIVEGDPR (Regulation (EU) 2016/679), controller for site visitors, processor for tenant data. See Privacy Policy.
• LIVEIrish Data Protection Act 2018, domestic implementation of GDPR.
• LIVEEU food safety regulations traceability requirements, Keystone's batch model is designed to evidence Art. 18 obligations end-to-end.
• ALIGNEDISO/IEC 27001:2022, our security controls are mapped to the Annex A control framework: access management, encryption, logging, incident response and vendor risk all follow the standard's structure.
• ALIGNEDNIS2 (EU Directive 2022/2555), customers in NIS2 scope (essential or important entities) can rely on Keystone's tenant isolation, MFA and immutable audit-trail controls as direct supporting evidence for their own obligations.

6. Data protection lead & ADPO membership

LIVECloudVoro operates with a Data Protection Lead (Privacy Contact) who handles subject access requests and supervisory-authority correspondence, reachable at privacy@cloudvoro.com.

Our founder Asif Khan is a member of the Association of Data Protection Officers (ADPO) Ireland, and CloudVoro reviews its data-protection governance on an ongoing basis to keep pace with customer contracts and regulatory expectations.

7. Sub-processors & vendor risk

Limited, named sub-processors with EU-or-equivalent data-protection guarantees. The current list, contact addresses and processing purposes are kept on a dedicated page, /legal/sub-processors. Material changes are emailed to the primary tenant contact 30 days before they take effect, in line with Art. 28(2) GDPR.

8. Vulnerability disclosure

If you believe you've found a security vulnerability in Keystone, please write to security@cloudvoro.com with steps to reproduce. We acknowledge within 2 business days and aim to provide a fix or mitigation timeline within 10 business days. We credit researchers publicly with permission and provide a written acknowledgement letter.

9. Backup & disaster recovery

• LIVEEncrypted MongoDB Atlas continuous backups, 30-day point-in-time recovery window.
• LIVERecovery Time Objective (RTO): 4 hours for full-region failure. Recovery Point Objective (RPO): < 1 minute under normal operation, ≤ 15 minutes worst case.

10. Incident response

We notify the primary tenant contact within 72 hours of confirming a personal-data breach, in line with Art. 33 GDPR. If you're a customer, the named contact for your tenant is recorded in your Master Services Agreement. Generic security notices land in your in-product Admin Console.

11. Customer responsibilities

Security is a shared model. The Customer is responsible for: choosing strong passwords / enabling MFA on super_admin accounts, granting least-privilege access via the Roles screen, keeping the tenant's contact list current, reviewing the audit log on a cadence appropriate to their certification scheme, and notifying us promptly of staff offboarding.