Security

Security your reviewers can sign off on.

How your data is protected across every Issyx product, and what your reviewers can ask us to demonstrate.

Your data, protected and kept separate.

01
Support access exists only while you allow it
Nobody at Issyx can open your account unless you have granted access to it. You issue the grant, you can see it while it is open, and you can withdraw it early.
02
You can tell our staff from your team
Every action taken inside your account is recorded against the person who took it, whether that person works for you or for us. A grant expires on its own, and the record of what was done while it was open stays with you.
03
Your data is isolated from every other customer
What you put into Issyx is visible to your own organisation and to nobody else. That holds for every product you use and every way in, including the API.
04
Review access to every product in one place
One sign-in covers every Issyx product, so who has access to what is one list to read and one place to change.
- SAML and OIDC single sign-on with domain verification, plus SCIM provisioning, so joiners and leavers follow your directory.
- Signing out revokes access immediately, and an administrator can sign a person out of every device at once.
05
Check that anything you receive came from us
Outbound webhooks are signed and timestamped, so your own system can confirm a message is genuinely from Issyx before it acts on it. Signing secrets rotate on your schedule.

Encryption: In transit and at rest, on every product, session credentials included.
Multi-factor authentication: Set in one place, and it applies to every product and everyone in your organisation.
Payment card data: Card payments are processed by a PCI DSS compliant payment provider. Issyx never stores card numbers.
Your data: Yours. Export any of it at any time, in a format you can open without us.
Subprocessors: A current list is available on request, with notice before any change.
Security questionnaires: We complete them in writing. Send yours through the contact page.

We answer in writing, and we can walk your reviewers through any of the controls above.