Trust centre
Evaluate the product before you connect.
Find the architecture, access model and evidence limits your engineers, security team and procurement reviewers need.
Security approach
Configuration metadata, source quarantine and execution admission.
Review security →ArchitectureDeployment options
See who operates the portal, workers, keys and evidence.
Compare deployments →IdentityMicrosoft Entra SSO
Organisation-scoped setup, access and offboarding considerations.
Read the setup guide →EvidenceWorked reference result
A synthetic result you can challenge without joining the portal.
Inspect evidence →| Area | Current position |
|---|---|
| Managed platform location | The current AWS control plane and portal run in the London region, eu-west-2. Identity services are a separate WorkOS boundary; agree the full processing and support scope before relying on residency. |
| Authentication | WorkOS AuthKit with server-managed sessions. Enterprise federation has an organisation-scoped setup path; directory-driven deprovisioning and multi-organisation administration need separate confirmation. |
| AWS access | Temporary STS role sessions for approved scope. No permanent access-key onboarding. Review the exact permission pack supplied at connection setup. |
| Application source | Selected Lambda ZIPs can enter encrypted, tenant-scoped quarantine with a 14-day lifecycle. Scanning and approval remain execution gates. |
| Application execution | Hosted execution requires the approved isolation and admission controls. The exercised customer reference path is a synthetic contract simulator. |
| Independent assurance | No ISO 27001 or SOC 2 certification, independent penetration-test report, contractual uptime or recovery guarantee is claimed here. Ask for available evidence before contracting. |
| Retention and deletion | Archiving stops monitoring and retains evidence. Complete erasure, backups, retention schedules and contract-specific obligations require an agreed deletion policy. |
Before a production agreement
Agree the legal contracting entity, privacy and data-processing terms, subprocessors and regions, retention and erasure, support and incident contacts, service levels, restore evidence and termination/export arrangements. Review the evidence for the deployment you will actually use.
Private early access is limited while these onboarding and operational gates are completed. We do not substitute an attractive architecture for evidence of a control.
Discuss your review