Security you can trust. Compliance you can prove.

Enterprise-grade security is not an add-on at SLAIQ — it's the foundation. Your service contracts contain your most sensitive commercial intelligence. We treat them accordingly.

CertifiedSOC 2 Type II
AlignedISO 27001
CertifiedGDPR Compliant
ActiveAES-256 Encryption

Certifications & Compliance

Certified

SOC 2 Type II

Security, Availability, Confidentiality & Privacy Trust Service Criteria. Annual audit by independent AICPA auditor.

Aligned

ISO 27001

Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022 across all 11 relevant Annex A control domains.

Certified

GDPR Compliant

EU data residency by default. Data Processing Agreements available. Documented legal bases for all processing activities.

Active

AES-256 Encryption

All data encrypted at rest (AES-256) and in transit (TLS 1.3). Credentials AES-256-CBC. Passwords bcrypt 12 rounds.

Security architecture

Encryption at Rest & In Transit

All data encrypted with AES-256 at rest. TLS 1.3 enforced for all connections. Integration credentials stored with AES-256-CBC, never plain text. HSTS preload in production.

Private AI Processing

Enterprise customers can process contracts on their dedicated vLLM cluster — data never leaves their infrastructure. Standard tier uses isolated tenant processing with no cross-tenant data flow.

RBAC & Immutable Audit Logs

9-role permission matrix enforced at every API endpoint. Every mutation logged with timestamp, userId, IP, before/after state. Logs are append-only and exported for compliance.

Complete Tenant Isolation

Row-level security enforced by organizationId on every database query. Cross-tenant data access is architecturally impossible — not just policy-restricted.

GDPR & EU Data Residency

Data stored in EU by default (eu-west-1). GDPR-compliant data processing agreements. Right to deletion honored within 30 days. Standard Contractual Clauses for transfers.

Penetration Testing & Scanning

Annual third-party penetration testing. CodeQL SAST in CI/CD pipeline. npm audit on every dependency change. Critical findings remediated within 72 hours.

Implemented security controls

Every item below is live in production code — not a roadmap item.

Zod schema validation on all write endpoints
HMAC-SHA256 webhook signature verification with timestamp replay prevention
Rate limiting (Redis-backed per-IP per-endpoint)
XSS sanitization (stripHtml) applied before storage
CSRF protection via NextAuth.js v5
HttpOnly, SameSite=Lax session cookies
Session encryption via AES-256-CBC (Auth.js)
Password bcrypt hashing (12 rounds)
API key storage as bcrypt hash (raw key shown once only)
Forgot-password tokens: 1-hour expiry, single-use
Invite tokens: 7-day expiry, single-use
File upload MIME type whitelist + 50MB size limit
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Security-Policy (unsafe-eval removed in production)
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
CORS restricted to same-origin (no CORS headers set)
Docker multi-stage build — minimal production image
GitHub Actions security scanning (CodeQL + npm audit)

Responsible Disclosure

Found a security vulnerability? Report it to security@slaiq.io. We acknowledge within 48h and fix confirmed vulnerabilities within 30 days.

Enterprise security

Built for enterprise trust

Your contracts are among your most sensitive assets. We protect them accordingly.

SOC 2 Type II

Annual third-party security audits. Our infrastructure meets the highest enterprise security standards.

End-to-end encryption

All documents and contract data encrypted at rest (AES-256) and in transit (TLS 1.3).

Tenant isolation

Strict row-level security. Your data is completely isolated — no cross-tenant access possible.

EU data residency

Data stored exclusively in EU data centers. GDPR compliant by design with DPA available.

Full audit logs

Immutable audit trail of every access, change, and export across your organization.

SSO & SAML

Enterprise SSO via Okta, Azure AD, or any SAML 2.0 provider. IP allowlisting supported.

Stop discovering problems in the rearview mirror

Join hundreds of enterprise service teams who turned contract chaos into operational clarity.

Avg onboarding time: 12 minutes · Typical ROI: 6–8× in year one