Security overview.
The controls REQOPS operates, the standards it is assessed against, and the documentation your security team can request.
Deployed in your environment.
REQOPS installs in your environment — your cloud account or your own hardware. Customer records remain on infrastructure you control, and no customer data is transmitted to REQOPS.
Summary of the program.
Encryption in transit and at rest.
TLS 1.2+ on every connection, AES-256 on every store and backup. Keys are held in a managed key service and rotated on schedule.
GDPR compliance.
DPA with standard contractual clauses, a public sub-processor list, data-subject requests handled within the statutory timeframes, and confirmed deletion.
SOC 2 Type II, ISO 27001, penetration testing.
SOC 2 Type II audited and ISO 27001 certified, with independent penetration tests annually — report, certificate and attestation available under NDA.
A documented incident response plan.
Severity matrix, named owners, prepared notification templates — customers notified without undue delay, regulators within 72 hours where GDPR applies.
Customer data is not used to train models.
A transparency statement lists every AI feature and the data that reaches it. No-training commitments are contractual, with human oversight and an AI kill switch.
Least-privilege access, reviewed quarterly.
Role-based access, an append-only audit trail, same-day removal for leavers, and signed quarterly access reviews.
Frequently asked in security reviews.
Available documentation.
The documents security reviews request, maintained and dated. Several are published in the policy library; the remainder are available on request.
Recurring security activities.
These activities run on a schedule, and each produces dated evidence.
Dependency alert review
Every alert closed or fixed, with the record retained.
Scans and backup checks
Vulnerability scan reviewed; backup jobs verified as running.
Access reviews
Every account on every system reviewed for need and least privilege, with sign-off.
Restore test
A backup restored and verified.
Incident exercise
A tabletop run of the incident response plan, with notes and actions filed.
Penetration test
Independent testers, full report, fixes retested — attestation letter available.
The program in three areas.
Send a questionnaire or name the documents you need at hello@reqops.io. NDA-controlled documents are provided under a signed NDA.