Security & Compliance

Security and privacy
at Alloovium

Your construction documents contain sensitive commercial information. Protecting them is fundamental to everything we build.

SOC 2 Type I in progress
AWS KMS encryption
Hosted in Sydney, Australia

Governance

Our security team establishes policies and controls, monitors compliance, and proves security posture to auditors.

Compliance is managed through Vanta, with a dedicated Technical Security Lead overseeing all security operations.

Our security policies are based on the following foundational principles:

01.

Least privilege

Access is limited to only those with a legitimate business need, enforced through role-based access control.

02.

Defence in depth

Security controls are layered across network, application, and data tiers — no single point of failure.

03.

Tenant isolation

Each organisation’s data is completely isolated at the database level. Cross-tenant access is architecturally impossible.

04.

Continuous improvement

Security controls are iterative, continuously maturing through monitoring, scanning, and incident response.

Security and compliance at Alloovium

Alloovium is currently pursuing SOC 2 Type I and ISO 27001 certification. Our compliance program is managed through Vanta, enabling continuous monitoring of our security controls and automated evidence collection.

SOC 2 Type I
ISO 27001
Certifications in progress

Data protection

Data at rest

  • All documents stored in AWS S3 with KMS encryption
  • PostgreSQL database encrypted via RDS encryption
  • Enterprise customers can provision BYOK (Bring Your Own Key)

Data in transit

  • TLS 1.2 or higher enforced on all connections
  • HTTP Strict Transport Security (HSTS) with 1-year max-age
  • Internal service communication over encrypted channels
  • SSL enforced on all database connections

Secrets management

  • All credentials stored in AWS Secrets Manager
  • No plaintext secrets in code or configuration
  • Separate credentials for staging and production environments
  • Task definitions reference secrets via secure ARN references

Infrastructure security

AWS cloud infrastructure

Alloovium runs on AWS in the ap-southeast-2 (Sydney, Australia) region, using serverless containers on ECS Fargate with multi-AZ load balancing. Our infrastructure is designed with network segregation as a core principle.

Network segregation

  • Private VPC with public/private subnet segregation
  • Databases and caches isolated in private subnets
  • Only load balancers exposed in public subnets
  • All application workloads run with public IP disabled

Private connectivity

  • VPC Endpoints (PrivateLink) for S3, ECR, SQS, Secrets Manager
  • No database traffic traverses the public internet
  • Security groups enforce strict ingress/egress rules
  • Worker services have deny-all inbound access

Environment segregation

Staging and production environments are completely separate — different databases, credentials, queues, secrets, and load balancers. A compromise in staging cannot affect production data.

Databases

Separate per env

Auth keys

Separate per env

SQS queues

Separate per env

Secrets

Separate per env

Application security

Security headers

Content Security Policy (CSP) with nonce-based scripts, X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy disabling camera, microphone, and geolocation.

Input validation

Pattern-based detection for SQL injection, XSS, path traversal, and command injection. Request size limits enforced. File upload endpoints validated.

Rate limiting

Tiered rate limiting is configurable via env settings: auth endpoints are on a higher threshold for frequent status checks, with separate limits for standard, ingestion, chat, and search routes.

CORS & host validation

No wildcard CORS origins in production — only alloovium.com domains allowed. Host header validation prevents injection attacks.

Fail-fast production validation

On every deployment, our application validates security settings at startup — CORS origins, JWT configuration, rate limiting, and auth settings. If any check fails, the application refuses to start.

Access control

Authentication

Enterprise-grade authentication via Clerk with support for email/password, Google, and Microsoft SSO. Optional two-factor authentication (TOTP) with backup codes.

Role-based access

Four role levels — Admin, Manager, Member, Viewer — with row-level security at the database layer. All API requests scoped to the authenticated user’s organisation.

API security

JWT verification (RS256) via JWKS on every API request. JWT secrets enforced to minimum 64 characters. Production startup validation blocks misconfigured deployments.

Monitoring & threat detection

Amazon GuardDuty

Continuous threat detection monitoring across CloudTrail logs, VPC Flow Logs, DNS logs, S3 data events, and RDS login activity.

Active — zero findings to date

Centralised logging

Structured application logging with request tracing (request ID, user ID, tenant ID) across all services via CloudWatch. Sensitive data automatically excluded from logs.

30-day log retention365-day audit logs

Vulnerability scanning

Dependabot enabled for automated dependency and security scanning. Software composition analysis (SCA) identifies known vulnerabilities across our dependency chain. Regular dependency updates with security patches prioritised.

Incident response

Documented incident response plan maintained in readiness. Dedicated security roles with clear escalation paths.

Zero security incidents reported

Data privacy

Your documents are your data. We never use customer documents to train AI models. All document processing happens within our secure infrastructure, and access is strictly limited to the authenticated users within your organisation.

Data residency

Primary infrastructure hosted in Sydney, Australia (AWS ap-southeast-2). Document storage and databases remain in-region.

Document access

Documents served via time-limited pre-signed URLs with 15-minute expiry. No permanent public URLs are generated.

Data deletion

Deleted documents are removed from storage and search indexes. You can request complete account data deletion at any time.

Questions about our
security practices?

We’re happy to discuss our security posture in detail. Reach out to our team for more information.