How we keep your data secure
AssuranceGrid runs on AWS with the same infrastructure and access-control patterns your own security team would look for in an audit. Here's exactly what that means, with nothing beyond what's actually running today.
AWS Fargate containers behind an Application Load Balancer, with PostgreSQL in a private, internet-unreachable subnet.
Hosted on AWS, isolated by design
Isolated networking
The database runs in an isolated subnet with no direct route from the internet, inside a VPC spanning two availability zones.
Encrypted in transit
All traffic is served over HTTPS via an AWS Certificate Manager certificate on the load balancer.
Managed secrets
Database credentials and signing keys live in AWS Secrets Manager and are only ever decrypted into the running application, never committed to code or config.
Infrastructure as code
Every environment change goes through AWS CDK as a reviewable diff, not a manual console click.
Centralized logging
Application and infrastructure logs flow to CloudWatch for monitoring and incident investigation.
Deletion protection
The production database has deletion protection enabled to guard against accidental data loss.
Access control that holds up to scrutiny
Token-based authentication
JWT sessions with a bounded expiry and server-side revocation on logout, not indefinitely valid tokens.
Hashed passwords
Passwords are hashed with bcrypt. AssuranceGrid never stores or can retrieve a plaintext password.
Role-based access control
8 distinct roles enforced at the API layer, with real separation of duties: policy authors, for example, cannot approve or publish their own policies.
Full audit trail
Every state-changing action is logged with the actor, timestamp, and before/after values, across every module.
Tenant isolation
Each customer's data is scoped to their own tenant throughout the data layer.
Process, not just tooling
Infrastructure changes go through code review and version control (AWS CDK), never a manual console edit.
Direct container shell access is disabled by default. It's only enabled temporarily, under an audited runbook, for genuine incident recovery, then immediately revoked.