> ## Documentation Index > Fetch the complete documentation index at: https://docs.reelevant.com/llms.txt > Use this file to discover all available pages before exploring further. # Security & Compliance > SOC 2 Type II certification, GDPR compliance, encryption standards, vulnerability management, vendors, and Reelevant's security posture for technical evaluators. ## Security Overview Reelevant maintains a comprehensive Information Security Programme overseen by a dedicated Risk Committee. The programme is reviewed at least annually and covers all aspects of data protection, access control, incident response, and vendor management. For the most up-to-date security documentation, certifications, and audit reports, visit the **[Reelevant Trust Centre](https://trust.reelevant.com)**. ## Certifications & Compliance | Standard | Status | Detail | | ----------------------- | --------------- | ---------------------------------------------------------------------------------------- | | **SOC 2 Type II** | Certified | Annual audit covering Security, Availability, and Confidentiality trust service criteria | | **GDPR** | Full compliance | Configurable retention, data minimisation, right to erasure, DPA available | | **Penetration testing** | Annual | Independent third-party assessment of all externally-accessible systems | ## Data Protection ### Encryption | Layer | Standard | | ------------------- | ------------------------------------------------------------------------------------- | | Data in transit | TLS 1.3 (minimum TLS 1.2) | | Data at rest | AES-256 disk encryption on all servers, workstations, and cloud storage | | Database encryption | Application-level encryption for sensitive fields; HTTPS for all database connections | | File transfer | Always over secure links (HTTPS, SFTP, or FTPS); PGP encryption can be added on top | ### Data Residency * **Primary region:** EU (additional regions planned) * **Multi-tenant architecture:** The platform operates a single production environment with strict logical tenant isolation — each customer's data is segregated through application-level access controls and scoping ### Data Minimisation * Only fields explicitly mapped in Datasources are accessible to the platform * No personal data is stored beyond the configured retention period * Production data is sanitised before use in non-production environments ### Retention Controls * Configurable per Datasource (default 90 days for behavioural events) * Secure disposal follows industry-accepted standards for data deletion * Disposal is tracked and documented ## Access Control ### Platform Access * **Multi-factor authentication (MFA)** required for all users * **SSO** supported via SAML 2.0 — see [Authentication & SSO](/why-reelevant/technical-evaluators/authentication) * **RBAC + ABAC** — Role-based permissions scoped by company and team attributes * **Least privilege** — Users receive the minimum access required for their role * **Quarterly access reviews** — All production system access reviewed by management ### Production Systems * Remote access restricted to authorised personnel with valid MFA token * VPN (IPSec / SSL) required for all remote production access * SSH key-based authentication for system-level access * Terminated employees have access revoked within 24 hours ## Vulnerability Management ### Scanning & Testing | Activity | Frequency | | ----------------------------------- | ------------------ | | Internal vulnerability scans | At least quarterly | | External vulnerability scans | At least quarterly | | Third-party penetration testing | Annually | | Network and application layer tests | Per test cycle | ### Remediation Timelines | Severity | Remediation window | | ------------------- | --------------------- | | Critical / Zero-day | Immediately to 7 days | | High | Within 14 days | | Medium / Low | Within 30 days | ### Patch Management All system patches are obtained from trusted sources and deployed at least monthly, with critical patches escalated for immediate deployment. ## Incident Response Reelevant maintains a dedicated Incident Response Team (IRT) with defined roles and procedures: * **Security events** (suspicious activity, no confirmed compromise) — investigated and tracked internally * **Security incidents** (confirmed compromise) — full IRT activation, documented investigation, customer notification if required * **Annual tabletop exercise** to test business continuity and disaster recovery procedures * **Post-incident reports** with root cause analysis and remediation actions ### Incident Severity Levels | Level | Definition | Response | | ------ | ----------------------------------------------------------------- | ---------------------------------------------------------------- | | Low | Attempted activity, no compromise (e.g. failed intrusion attempt) | Investigation, internal tracking | | Medium | Suspicious deviation from normal behaviour | Elevated monitoring, potential escalation | | High | Confirmed compromise, unauthorised access | Full IRT response, potential customer and authority notification | ## Business Continuity * **Multi-region active-active** failover architecture * **Daily full backups** of all production data, stored in secure remote locations * **180-day backup retention** with annual restore testing * **Recovery objectives** tested annually via tabletop exercises ## Vendor Management Reelevant assesses all vendors for criticality and risk before engagement: * Vendors handling sensitive or confidential data undergo enhanced due diligence * Critical and high-risk vendors are reviewed at least annually via compliance reports * All vendors must comply with Reelevant's information security policies ### Infrastructure Vendors Reelevant runs on a short, deliberately limited list of infrastructure vendors: | Vendor | Service | Region | Role | | ---------------- | ------------------ | --------------------------------- | ------------------------------------------------------------------------- | | **OVHcloud** | Bare metal servers | France | Hosts the platform: application services, databases, and event processing | | **Google Cloud** | BigQuery | Belgium | Analytics warehouse used for event storage and reporting queries | | **AWS** | Route 53 (DNS) | Global (anycast, as DNS requires) | Public DNS resolution for Reelevant domains — no customer data | ## Audit Logging * **Audit logs retained for 1 year** * All admin actions logged with user attribution and timestamp * Authentication events (successful and failed) captured and monitored * File integrity monitoring and host-based intrusion detection deployed * Log data protected for confidentiality, integrity, and availability ## Reporting a Security Issue Report suspected vulnerabilities or security incidents to **[security@reelevant.com](mailto:security@reelevant.com)**. | Contact | Role | | ----------------- | ---------------------------------------------------------------------- | | Valentin Marchaud | CTO — security contact and owner of the Information Security Programme | Include reproduction steps and affected endpoints where possible. Reports are triaged by the Incident Response Team and remediated according to the timelines above. ## Security Awareness * All employees complete security awareness training within 30 days of hire * Annual refresher training required * Background checks performed on all new hires * Confidentiality agreements signed before system access is granted ## Learn More Up-to-date certifications, audit reports, and security documentation. Real-time platform availability and incident history. Release policy, notice periods, and compatibility guarantees.