Trust, Security & Technical Safeguards
We publish only technical controls that are genuinely implemented in our codebase. We do not make unsupported compliance claims or certification guarantees.
Honest Framework & Compliance Position
In accordance with our legal requirement standards, EFIS does not display generic “GDPR Compliant”, “SOC 2 Certified”, or “Bank-Grade” badges. Instead, we provide accurate status disclosures based on verified evidence:
SOC 2 / ISO Assurance
Formal independent audit roadmap is scheduled; controls are implemented in code.
Data Processing Addendum
DPA and subprocessor disclosures are in draft under legal review and not yet published for commercial reliance.
Technical Controls
Tenant isolation, encryption at rest/transit, and immutable audit logs verified in codebase.
Strict Multi-Tenant Isolation
Every database query and S3 file path is strictly scoped by `tenant_id` extracted from the RS256 JWT cookie inside FastAPI middleware. Tenant ID is never accepted from client request bodies.
AI CFO Refusal & Explainability Engine
AI queries run through a confidence scoring envelope (0–100). When confidence is below 40%, the engine refuses to answer and requests specific missing data. Unverified numbers are flagged.
Immutable Append-Only Audit Logging
Access logs and AI audit logs are append-only tables with PostgreSQL triggers blocking UPDATE and DELETE operations. Audit records are retained for 7 years.
Role-Based Access Control (RBAC)
Enforces 7 granular roles (Super Admin, Tenant Admin, CFO, Finance Director, Controller, Treasury, Viewer) across all API endpoints with strict denial logging.
Data Quality & Financial Lineage
Calculates an explicit Data Quality score for every upload and reports cell-level lineage tracing back to General Ledger journal entries.
Vulnerability & Incident Reporting
Authorized security researchers can report vulnerabilities directly to our security team. We maintain a documented incident assessment process.
Vulnerability Reporting & Security Contact
Have a security query or wish to report a vulnerability? Contact our engineering team at security@efis.io.