Security is Essential to Confidion Sentry
At Confidion, we take the security and privacy of our customers' data extremely seriously. We understand that our customers trust us with sensitive intelligence data and we are committed to safeguarding it.
Our commitment to security and privacy is an ongoing effort, and we are constantly working to improve our systems and processes. We believe that our customers deserve nothing less than the highest level of security and privacy, and we will continue to make it our top priority.
Compliance
Frameworks and standards we align with and are working towards.
SOC 2 Type II
AICPA Trust Service Criteria
In ProgressNIST CSF 2.0
Cybersecurity Framework
AlignedCIS Critical Security Controls
v8.1 Implementation
In ProgressOWASP Top 10
Web Application Security
ActiveCloud Infrastructure
Our platform infrastructure is hosted with enterprise-grade cloud providers that maintain SOC 2 Type II, ISO 27001, and PCI DSS certifications. All data is encrypted in transit (TLS 1.2+) and sensitive data is encrypted at rest using AES-256-GCM. Our Collector Agent ingestion pipeline uses hybrid encryption (X25519 ECDH key exchange + AES-256-GCM) for end-to-end protection of user-submitted files.
Data Types Collected
Policies & Standards
Our documented security policies aligned with SOC 2 Trust Service Criteria.
Information Security Policy
Defense-in-depth principles, access control, secure development practices, and infrastructure hardening standards.
Policy · CC1.1, CC6.1Incident Response Plan
SEV-1 through SEV-4 severity classification, 5-phase response process, evidence preservation, and stakeholder communication procedures.
Policy · CC7.3, CC7.4Data Classification & Retention Policy
Four-level classification (Restricted, Confidential, Internal, Public), data inventory mapping, retention periods, and data subject rights.
Policy · CC6.5, P5.1Change Management Policy
Standard, Normal, and Emergency change types with peer review requirements, pre-deployment checklists, and rollback procedures.
Policy · CC8.1Business Continuity & DR Plan
99.5% uptime SLA, RPO of 4 hours, RTO of 2 hours, backup procedures, and disaster recovery scenarios.
Policy · A1.2, A1.3Vendor Risk Management Policy
Four-tier vendor classification, onboarding security assessments, contractual requirements, and ongoing monitoring procedures.
Policy · CC9.1, CC9.2Access Control Policy
User provisioning and deprovisioning, quarterly access reviews, RBAC roles, MFA requirements, and emergency revocation procedures.
Policy · CC6.1, CC6.3, CC6.4Acceptable Use Policy
Personnel and platform user conduct expectations, OSINT-specific ethics, prohibited activities, and enforcement procedures.
Policy · CC1.3, CC1.4Risk Assessment Policy
Documented risk assessment methodology, likelihood/impact scoring, fraud risk assessment, and threat identification procedures.
Policy · CC3.1, CC3.2, CC3.3Data Protection Policy
Encryption controls, data subject rights with per-jurisdiction response timelines, breach notification, and third-party data sharing rules.
Policy · C1.1, P1.1, P8.1Asset Management Policy
Asset lifecycle management, cryptographic key inventory, software dependency tracking, and decommissioning procedures.
Policy · CC6.5, CC6.8Collector Agent Security Policy
End-to-end encrypted file ingestion, agent registration and approval workflow, hybrid key exchange, and compromise response procedures.
Policy · CC6.1, CC6.7Data Ingestion Security Policy
Input validation, source authentication, malware scanning, rate limiting, and data lineage tracking for all external data pathways.
Policy · CC6.6, PI1.1Cryptographic Key Management Policy
Key generation standards, lifecycle management, rotation procedures, backup and escrow, and compromise response for all cryptographic material.
Policy · CC6.1, CC6.7AI Governance Policy
Responsible AI principles, model transparency, bias assessment, human review requirements, and AI output disclaimer standards.
Policy · CC1.1, PI1.1Multi-Tenancy Security Policy
Team data isolation, permission boundaries, cross-team access controls, and tenant lifecycle management procedures.
Policy · CC6.1, CC6.3Security Documentation
Additional security resources and assessments.
SOC 2 Compliance Checklist
Comprehensive readiness assessment covering all five Trust Service Criteria with gap analysis and 16-week remediation roadmap.
AssessmentZero Trust Security Plan
UX-first approach to zero trust architecture covering identity, authorization, encryption, monitoring, and infrastructure hardening.
ArchitectureSecurity Review Report
Comprehensive security assessment with identified findings, risk ratings, and prioritized remediation timeline.
AssessmentData Protection Impact Assessment
GDPR Article 35 assessment covering OSINT profiling, AI-generated analysis, automated decision-making, and data subject rights.
AssessmentSecurity Controls
Technical and organizational controls protecting our platform and your data. 235 of 235 controls implemented.
Authentication & Identity 45 controls
Data Protection & Encryption 35 controls
Application Security 40 controls
Rate Limiting & Abuse Prevention 25 controls
Monitoring & Logging 30 controls
Organizational Security 30 controls
Infrastructure Security 30 controls
Subprocessors
Third-party service providers that process data on our behalf. Currently 11 active subprocessors.
| Vendor | Service | Data Shared | Location | Risk Tier |
|---|---|---|---|---|
|
Stripe
Payment Processor
|
Payment processing & subscription billing | Customer email, billing details, subscription data | USA | Tier 1 — Critical |
|
Microsoft Azure OpenAI
AI Analysis Engine
|
AI-powered analysis, embeddings & semantic deduplication | Search queries, OSINT content for analysis | Canada | Tier 1 — Critical |
|
Hosting Provider
Cloud Infrastructure
|
Server infrastructure & hosting | All platform data | Canada | Tier 1 — Critical |
|
OpenWebNinja
OSINT Data Provider
|
Multi-source OSINT API for email search, image search, business data, finance data & review aggregation | Search queries, email addresses, entity identifiers | USA | Tier 1 — Critical |
|
SMTP2Go
Email Delivery
|
Transactional email delivery | Recipient email addresses, email content | New Zealand | Tier 2 — Important |
|
Twilio
SMS Gateway
|
SMS provisioning & delivery for crowd-sourced intelligence submissions | Phone numbers, SMS message content | USA | Tier 2 — Important |
|
NewsAPI / GNews / Mediastack
News Data Feeds
|
Real-time news aggregation | Search queries, topic keywords | Various | Tier 2 — Important |
|
USGS / EMSC / IRIS
Environmental Sensors
|
Earthquake and seismic data feeds | Geographic query parameters | USA / EU | Tier 3 — Standard |
|
Google Fonts
Web Fonts CDN
|
Font delivery (CDN) | User IP addresses (via browser request) | USA | Tier 3 — Standard |
|
DuckDuckGo
Web Search Engine
|
Privacy-focused web search — no API key required | Search queries | USA | Tier 3 — Standard |
|
SANS ISC / OpenPhish / URLhaus / Cisco Talos / CISA
Threat Intelligence Feeds
|
Free real-time threat intelligence feeds for IP reputation, phishing URLs, malware distribution & known exploited vulnerabilities | IP addresses, threat indicator queries | USA / EU | Tier 3 — Standard |
Frequently Asked Questions
Do you encrypt data in transit and at rest?
Do you support Multi-Factor Authentication (MFA)?
What compliance frameworks do you follow?
How do you handle security incidents?
How do you manage third-party vendor risk?
What is your data retention policy?
How can I report a potential security issue?
What uptime SLA do you offer?
What is the Collector Agent and how is data secured?
How does the AI/NLP analysis work and what data is shared?
How is team data isolated?
Security Updates
Recent security improvements, compliance milestones, and advisories.
Trust Centre Auto-Update System
Controls, subprocessors, and security updates on the Trust Centre page are now dynamically sourced from the database, ensuring the page stays current as the platform evolves.
Trust Centre Launch
Launched our public Trust Centre, providing transparency into our security posture, compliance efforts, and data handling practices. This page is dynamically updated as we progress towards SOC 2 Type II certification.
Trust Centre Auto-Update System
Controls, subprocessors, and security updates on the Trust Centre page are now dynamically sourced from the database, ensuring the page stays current as the platform evolves.
Trust Centre Launch
Launched our public Trust Centre, providing transparency into our security posture, compliance efforts, and data handling practices. This page is dynamically updated as we progress towards SOC 2 Type II certification.
Trust Centre Auto-Update System
Controls, subprocessors, and security updates on the Trust Centre page are now dynamically sourced from the database, ensuring the page stays current as the platform evolves.
Trust Centre Launch
Launched our public Trust Centre, providing transparency into our security posture, compliance efforts, and data handling practices. This page is dynamically updated as we progress towards SOC 2 Type II certification.
Trust Centre Auto-Update System
Controls, subprocessors, and security updates on the Trust Centre page are now dynamically sourced from the database, ensuring the page stays current as the platform evolves.
Trust Centre Launch
Launched our public Trust Centre, providing transparency into our security posture, compliance efforts, and data handling practices. This page is dynamically updated as we progress towards SOC 2 Type II certification.
PII Field Encryption Service
Implemented FieldEncryptionService providing application-level encryption for PII fields with searchable blind indexes (HMAC-SHA256), supporting SOC 2 CC6.7 and C1.2 criteria.
Entity Profile Encryption
Extended application-level AES-256-GCM encryption to entity profile data, adding encrypted storage with automatic encrypt/decrypt on read and write operations.
Comprehensive Security Assessment
Completed an internal security review identifying areas for improvement across authentication, authorization, data protection, and infrastructure. A prioritized remediation plan has been established and is actively being executed.
Security Headers & Rate Limiting
Implemented comprehensive security headers (HSTS with preload, CSP, X-Frame-Options, Referrer-Policy), rate limiting across login, registration, and API endpoints, and IP blocklist with auto-expiration.
MFA & Encryption Enhancements
Deployed TOTP-based Multi-Factor Authentication with backup codes, AES-256-GCM encryption for API keys and secrets, encrypted email storage with blind indexes, and enhanced session security with fingerprinting and idle timeouts.
Zero Trust Security Architecture Plan
Published a comprehensive Zero Trust Security Plan covering identity hardening, per-request authorization, end-to-end encryption, continuous monitoring, and infrastructure hardening with a 12-week implementation roadmap.
SOC 2 Policy Framework Established
Six comprehensive security policies documented covering Information Security, Incident Response, Data Classification & Retention, Change Management, Business Continuity & DR, and Vendor Risk Management — aligned with SOC 2 Trust Service Criteria.
PII Field Encryption Service
Implemented FieldEncryptionService providing application-level encryption for PII fields with searchable blind indexes (HMAC-SHA256), supporting SOC 2 CC6.7 and C1.2 criteria.
Entity Profile Encryption
Extended application-level AES-256-GCM encryption to entity profile data, adding encrypted storage with automatic encrypt/decrypt on read and write operations.
Comprehensive Security Assessment
Completed an internal security review identifying areas for improvement across authentication, authorization, data protection, and infrastructure. A prioritized remediation plan has been established and is actively being executed.
Security Headers & Rate Limiting
Implemented comprehensive security headers (HSTS with preload, CSP, X-Frame-Options, Referrer-Policy), rate limiting across login, registration, and API endpoints, and IP blocklist with auto-expiration.
MFA & Encryption Enhancements
Deployed TOTP-based Multi-Factor Authentication with backup codes, AES-256-GCM encryption for API keys and secrets, encrypted email storage with blind indexes, and enhanced session security with fingerprinting and idle timeouts.
Zero Trust Security Architecture Plan
Published a comprehensive Zero Trust Security Plan covering identity hardening, per-request authorization, end-to-end encryption, continuous monitoring, and infrastructure hardening with a 12-week implementation roadmap.
SOC 2 Policy Framework Established
Six comprehensive security policies documented covering Information Security, Incident Response, Data Classification & Retention, Change Management, Business Continuity & DR, and Vendor Risk Management — aligned with SOC 2 Trust Service Criteria.
PII Field Encryption Service
Implemented FieldEncryptionService providing application-level encryption for PII fields with searchable blind indexes (HMAC-SHA256), supporting SOC 2 CC6.7 and C1.2 criteria.
Entity Profile Encryption
Extended application-level AES-256-GCM encryption to entity profile data, adding encrypted storage with automatic encrypt/decrypt on read and write operations.
Comprehensive Security Assessment
Completed an internal security review identifying areas for improvement across authentication, authorization, data protection, and infrastructure. A prioritized remediation plan has been established and is actively being executed.
Security Headers & Rate Limiting
Implemented comprehensive security headers (HSTS with preload, CSP, X-Frame-Options, Referrer-Policy), rate limiting across login, registration, and API endpoints, and IP blocklist with auto-expiration.
MFA & Encryption Enhancements
Deployed TOTP-based Multi-Factor Authentication with backup codes, AES-256-GCM encryption for API keys and secrets, encrypted email storage with blind indexes, and enhanced session security with fingerprinting and idle timeouts.
Zero Trust Security Architecture Plan
Published a comprehensive Zero Trust Security Plan covering identity hardening, per-request authorization, end-to-end encryption, continuous monitoring, and infrastructure hardening with a 12-week implementation roadmap.
SOC 2 Policy Framework Established
Six comprehensive security policies documented covering Information Security, Incident Response, Data Classification & Retention, Change Management, Business Continuity & DR, and Vendor Risk Management — aligned with SOC 2 Trust Service Criteria.
PII Field Encryption Service
Implemented FieldEncryptionService providing application-level encryption for PII fields with searchable blind indexes (HMAC-SHA256), supporting SOC 2 CC6.7 and C1.2 criteria.
Entity Profile Encryption
Extended application-level AES-256-GCM encryption to entity profile data, adding encrypted storage with automatic encrypt/decrypt on read and write operations.
Comprehensive Security Assessment
Completed an internal security review identifying areas for improvement across authentication, authorization, data protection, and infrastructure. A prioritized remediation plan has been established and is actively being executed.
Security Headers & Rate Limiting
Implemented comprehensive security headers (HSTS with preload, CSP, X-Frame-Options, Referrer-Policy), rate limiting across login, registration, and API endpoints, and IP blocklist with auto-expiration.
MFA & Encryption Enhancements
Deployed TOTP-based Multi-Factor Authentication with backup codes, AES-256-GCM encryption for API keys and secrets, encrypted email storage with blind indexes, and enhanced session security with fingerprinting and idle timeouts.
Zero Trust Security Architecture Plan
Published a comprehensive Zero Trust Security Plan covering identity hardening, per-request authorization, end-to-end encryption, continuous monitoring, and infrastructure hardening with a 12-week implementation roadmap.
SOC 2 Policy Framework Established
Six comprehensive security policies documented covering Information Security, Incident Response, Data Classification & Retention, Change Management, Business Continuity & DR, and Vendor Risk Management — aligned with SOC 2 Trust Service Criteria.