The controls procurement asks about

Six layers, each already in production, not a roadmap of someday.

You're signing a portfolio onto a platform that holds resident PII. The diligence questions have real answers: here's what's protecting the data on day one.

Access control MFA, role-based, least privilege. Most routes check an explicit permission for the action; a small set — your own account, MFA and help pages among them — require only sign-in. MFA — passkeys and email codes — is enforceable for staff, with trusted devices and recovery codes. Unique account per user; no shared logins. Company-scoped API keys are minted by a Company Admin. The public API is server-to-server, no CORS, no user OAuth. Developer docs: https://developers.fixgrid.app/ Passkeys / WebAuthnEmail codesPer-module permissions

Tenant isolation Scoped at the query layer. Queries for your data carry your company as a filter in the query itself, rather than a check applied after the data comes back. Scoping every new query this way is a standing rule in our code review. Query-level scopingCompany-scoped queries

Encryption Encrypted in transit and at rest. TLS enforced site-wide via Cloudflare. AES-256 at rest across managed PostgreSQL and object storage. Passwords, tokens and API keys are never written to application logs. TLS site-wideAES-256 at rest

Audit log Append-only, across 17 categories. Sign-in and MFA, authorization denials, user lifecycle, billing, webhooks and integrations, data exports, FixGrid support actions and security events — written to a log the database refuses to alter or delete. Who did what, when, on which record. The full log is FixGrid's internal evidence trail; admins see each user's recent activity in the app. Append-onlyDatabase-enforced

Secure development Enforced before code is written. A standing ten-rule security ruleset is checked at write time on every change. Semgrep runs as a blocking CI check on every push and pull request; Bandit and pip-audit run before each production push. ORM-only queries and global auto-escaping structurally rule out SQL injection and XSS. Semgrep CI checkBandit + pip-audit0 open High

Edge defense Hardened at the perimeter. Cloudflare provides edge TLS and DDoS resilience. Turnstile guards public forms, rate limiting throttles abuse, and a full set of security headers — CSP, HSTS, frame-ancestors — ships on every response. Cloudflare DDoSTurnstileRate limiting

Enforced before written, not audited after

Most teams scan for vulnerabilities after they ship. We check for them before code ships.

Security isn't a quarterly review here — it's a property of the codebase. A standing ruleset flags insecure patterns at write time, a Semgrep check in CI fails on any un-triaged finding, and zero open Critical/High findings is the bar before code ships. The result isn't a promise; it's a pipeline.

Write timeSecurity rulesetInsecure patterns are flagged as code is written, not discovered later enforced

Static analysisSemgrepRuns in CI on every push and pull request and fails on any un-triaged finding CI gate

Code & dependenciesBandit + pip-auditRun before each production push; findings and third-party CVEs are fixed or triaged before code ships pre-push

Dynamic testingAuthenticated OWASP ZAPActive scan across 160 paths behind login — zero High findings after triage, as of 2026-09-10 0 High

Ship gateZero open Critical / HighFindings are remediated before code ships — the bar is held, not aspired to held

Multi-tenant isolation

Your data is scoped to your company in the query, not filtered after the fact.

The most expensive failure in shared software is one customer seeing another's data. FixGrid's rule is to scope each query for your data to your company in the query itself, rather than fetching broadly and filtering afterward. That filter is written into each query, so checking it is a standing part of reviewing every change, and any query found without it is treated as a security defect.

Scoped in the query — your company is a filter in the database query, not a check applied after.
Reviewed on every change — new queries are checked against the scoping rule before they ship.

Request · authenticated as

Riverside PM → fetch service_history
scope = company_id: riverside-pm

Riverside PMcompany_id: riverside-pm Returned · 248 records

Lakeside Groupcompany_id: lakeside-grp Out of scope

Hartwell Residentialcompany_id: hartwell-res Out of scope

The scope is in the query. Rows outside your company aren't fetched in the first place, so they never travel downstream.

Validations & roadmap

What's verified today, and what we're honest about still building.

Self-attested and scan-verified trust is in place now. The paid third-party layer that unlocks enterprise procurement is sequenced deliberately, cheapest and most-required first. We'd rather tell you exactly where the line is than imply a badge we don't hold.

In place todayVerified

CSA STAR Level 1 · CAIQ v4.1Listed publicly; the standard security questionnaire is answered and on file.
Authenticated OWASP ZAP — 0 High · as of 2026-09-10Active scan across 160 paths behind login, not just the public surface; the one raw High was a confirmed false positive. Nuclei's 10,133-template sweep the same round: 0 real vulnerabilities. Full triage in the September 2026 scan report.
PCI resolved via StripeCard data never touches our servers; AOC on file. Webhook signatures verified.
10-document policy setInformation Security Policy, DPA template, Incident Response Plan, sub-processor list — shareable on request.
Append-only audit log + MFAAppend-only event trail across 17 categories; enforceable multi-factor for staff.

On the roadmapSequenced

Cyber liability insuranceThe first contract requirement on signing an enterprise deal — sequenced first.
Independent penetration testEngagement pack drafted. The highest-credibility single artifact after insurance.
SOC 2 Type IIThe enterprise capstone — pursued when pipeline justifies it, building on the two above.

Why the candor? Real security teams read pay-for-display trust seals as a negative signal. We'd rather show you a scan report (PDF) and a policy set you can actually read than claim a certification that isn't operational yet. When it is, it'll be listed here — dated.

Security enforced before the first line of code.

Six layers, each already in production, not a roadmap of someday.

Most teams scan for vulnerabilities after they ship. We check for them before code ships.

Your data is scoped to your company in the query, not filtered after the fact.

What's verified today, and what we're honest about still building.

Send us your security review. We'll answer it line by line.