Security

Baseline controls

• Encryption in transit (TLS) and at rest on our primary data stores.
• Tenant isolation with row-level security in Postgres.
• Role-based membership (owner, admin, member, viewer) and field-level visibility.
• Audit logs for sensitive actions.
• Two-factor authentication is available under Profile → Security and recommended for paid manager seats. Once enabled, Connect, Save, and CRM require it. SSO is on the roadmap.
• Least-privilege access for staff and subprocessors.

Application security

Changes go through review and automated checks. Secrets are kept out of the client. Demo mode is isolated from production credentials. We do not ask the mobile apps for camera, photos, or Face ID.

Vendors

Hosting, auth, billing, and AI inference are provided by the companies on Subprocessors. We review their security documentation as part of onboarding and periodically after that.

AI

Unauthorized tenant data is not sent to models. Generation that faces a counterparty is designed to stay evidence-backed, with a human approval step before send where that feature exists. See AI transparency.

Incident response

If we confirm a personal-data breach that affects you, we will notify you and, where required, regulators without undue delay. Email suspected issues immediately to security@allocatin.com. Please include the account email, time window, and any indicators of compromise. Do not attach live credentials.

Your responsibilities

• Use a company email you control and keep seats current when people leave.
• Choose strong unique credentials and enable MFA on paid manager seats (Profile → Security).
• Do not upload material you are not allowed to share.
• Set visibility rules before publishing institutional fields.

Assurance roadmap

We are not claiming a current SOC 2 or ISO 27001 report on this page. Our internal roadmap is policies and vendor reviews first, then independent testing and SOC 2 readiness, then Type I / Type II as the business matures. Customers can request the latest questionnaire at security@allocatin.com.