Trust centre Plainly stated
What we do, and what we do not claim.
Where we stand on security today. Each area below is in place, planned or not claimed, and where something does not exist yet, this page says so. No certifications are claimed. In plain words: a list of what we have done to protect your information, and what we have not.
Read About this page
What we do, and what we do not claim
Where we stand on security today, stated plainly: what is in place, what is planned and what is not claimed. Where something does not exist yet, the page says so.
This page is kept honest on purpose. It will change as 7Analytica does, and the changelog records when it does.
01 Security posture
Eight areas, counted honestly.
In place means it runs today. Planned means we intend to do it. Not claimed means we do not say it, and will not until it is true.
4In place
- Encryption in transit
- Encryption at rest
- Password storage
- Access control
3Planned
- Independent penetration test
- Single sign-on for organisations
- Security attestation
1Not claimed
- Certifications held today
Read Every area and what it means
Security posture
| Area | Status | What it means |
|---|---|---|
| Encryption in transit | In place | TLS for all traffic between your browser and 7Analytica. |
| Encryption at rest | In place | Stored data is encrypted at rest. |
| Password storage | In place | Salted, one-way hashes. We cannot read a password. |
| Access control | In place | Role-based, least privilege and logged. Multi-factor authentication for administrative access. |
| Independent penetration test | Planned | A test by an outside firm, with a summary of scope and result published here. |
| Single sign-on for organisations | Planned | SAML or OIDC sign-in for teams that need it. |
| Security attestation | Planned | Working towards an attestation. We will name it once an audit is engaged. |
| Certifications held today | Not claimed | None. We will not call ourselves certified or compliant with a standard until we are. |
02 Policies
The rules we hold ourselves to.
Read What each policy covers
Policies
- Terms of Use
- The terms on which 7Analytica is provided.
- Security and provenance
- How records are made verifiable and how data is protected.
03 Subprocessors
Who else handles data.
A subprocessor is another company that handles data for us. They are listed by category. Named providers will be listed here before production launch, with a way to be told of changes.
Read Who else handles data, in full
Who else handles data
By category. Named providers will be listed here before production launch, with a way to be told of changes.
| Category | Purpose | Data | Status |
|---|---|---|---|
| Cloud hosting | Runs the application and stores data. | Account data, notes, preferences | Provider to be named when production hosting is final |
| Content delivery | Serves the website and static assets. | Technical request data | Provider to be named when production hosting is final |
| Identity providers | Google and Microsoft sign-in, when you choose them. | Name, email, identifier from the provider | Used only if you sign in with them |
| Email delivery | Sends verification and service messages. | Email address, message content | Provider to be named before launch |
| Map and imagery tiles | Draws the map and globe. | Tile requests | Offline vector style available without a provider |
Next
Found something? Tell us.
We welcome reports of vulnerabilities, made in good faith. Write to the address below.
Read What to send, and what happens next
Found something? Tell us.
We welcome reports of vulnerabilities, made in good faith. Write to the address below.
- What to send
- What you found, the steps to reproduce it, the page where it occurs and what you think the impact is. A short note is enough.
- What to avoid
- Reading, changing or deleting other people's data, degrading 7Analytica, and social engineering of staff or users.
- What happens next
- We read every report and replies to the address it came from. We say what we found and, when it is fixed, that it is fixed.
- Credit
- If you would like to be credited once an issue is resolved, say so and how you would like to be named.