1. Infrastructure
iSada runs on enterprise cloud infrastructure with redundancy across multiple availability zones. Our edge is fronted by Cloudflare for DDoS mitigation, bot management, and WAF protection.
- Hosting: AWS (US-East and Canada-Central), with full geo-redundant backups.
- Edge: Cloudflare Enterprise (DDoS, WAF, bot management, rate limiting).
- Uptime target: 99.9% measured monthly.
- Backups: Encrypted automated backups with point-in-time recovery, retained 30 days.
- Network isolation: Private VPCs, security groups, and least-privilege IAM roles for all internal services.
2. Encryption
All customer data is encrypted in transit and at rest using industry-standard cryptography.
- At rest:
AES-256-GCM for databases, object storage, and call recordings.
- In transit:
TLS 1.3 on all public endpoints (HSTS preloaded). Internal service-to-service traffic uses mTLS.
- Key management: AWS KMS with annual key rotation; envelope encryption for sensitive fields.
- Secrets: API tokens hashed with bcrypt; OAuth tokens encrypted in the database.
3. Access Controls
Strict safeguards ensure only authorized people and systems can access sensitive data.
- Role-based access control (RBAC): Customers can configure roles per dashboard user (owner, admin, agent, viewer).
- Multi-factor authentication (MFA): Required for all iSada staff; available and recommended for all customer admins.
- Single sign-on (SSO): SAML 2.0 SSO available on Enterprise.
- Principle of least privilege: Staff access to production is just-in-time, audited, and tied to ticketed work.
- Audit logs: Every access to sensitive data is logged with user, timestamp, IP, and action.
4. Compliance
We’ve engineered iSada with strong security and data-protection controls. Rather than external badges, here is exactly what we do:
- You keep your own API keys — your LLM, voice, and telephony credentials stay yours.
- Your data stays yours — export it to CSV or permanently delete it anytime from the dashboard.
- Encryption everywhere — AES-256 at rest and TLS 1.3 in transit.
- Access control — role-based access (RBAC) plus MFA, with strict multi-tenant isolation.
5. Incident Response
We operate a documented incident response process with defined severity levels and on-call coverage.
- 24/7 monitoring with paging for production incidents.
- Breach notification — we promptly notify affected customers of any confirmed breach.
- Post-incident review for all sev-1 and sev-2 incidents, with remediation tracked to closure.
- Runbooks reviewed and updated quarterly.
- Tabletop exercises conducted annually with engineering and leadership.
6. Data Residency
Customer data is stored in the region selected at signup. Available regions:
- Canada (default for Canadian customers) — AWS ca-central-1.
- United States — AWS us-east-1.
- European Union — AWS eu-west-1 (available on request).
Data does not leave the chosen region for primary storage. Encrypted backups may replicate to a paired region for disaster recovery, with the same residency boundary.
7. Vulnerability Disclosure
We welcome reports from the security research community. If you believe you have found a security vulnerability in the iSada platform:
- Email [email protected] with details and reproduction steps.
- Encrypt sensitive details with our PGP key (available on request).
- Allow us reasonable time to investigate and remediate before public disclosure.
- We commit to acknowledging valid reports within 48 hours and triaging in good faith.
We do not currently operate a paid bug bounty, but we publicly acknowledge researchers in our hall of fame with permission.
