Data Security
How your documents, records and Statement of Applicability are protected — only what is actually implemented.
Compliance records are sensitive: policies, risk decisions, evidence. Many online tools keep every customer in one big shared database, separated only by a “company ID” on every row. One missing filter in the code is enough for data to show up in the wrong place.
Standardico is built differently. When your company account is created, we create a brand-new database just for you.
Typical shared setup
Everyone's data in the same tables — kept apart only by code.
Standardico
A separate database per company — physically apart.
| Shared database | Standardico | |
|---|---|---|
| How data is separated | A company ID on every row | A separate database per company |
| Risk of seeing another company's data | One missed filter can expose it | Your session only ever connects to your database |
| Uploaded files | Often one shared bucket | Private, served only to your company |
Layers of protection
Your own database
Every company account gets a separate, isolated database. Your documents, Statement of Applicability, revision history and company profile are never stored next to another customer's data.
Private files
Uploaded files such as your company logo are stored privately — never behind a public link — and are only served to people signed in to your company.
Encrypted connections
All traffic uses HTTPS with HSTS. Session cookies are secure and HTTP-only.
Roles that separate duties
Viewers read, editors prepare, managers approve, company admins manage people and settings. An editor cannot approve their own changes.
A full change history
Every save of a document or your Statement of Applicability creates a new version with the date, a description of what changed, the author and — once approved — who approved it.
Passwords stored safely
Passwords are stored only as a strong one-way hash (bcrypt), never in plain text.
Separate staff access
Our own platform staff accounts are a separate system from your company accounts. A staff login cannot be used to sign in to your company.
Hardened for production
Debug output is switched off in production, and the application sends security headers (HSTS, no content-type sniffing, frame protection).
Questions about security?
Ask us anything about how Standardico stores and protects your data.
Contact us Request a demo