---
title: "Security and data protection | SalexHub"
description: "What protects your data in SalexHub today, each claim with where it stands, and what we do not claim yet."
url: "https://salexhub.com/security"
---

# Security you can check.

What protects your data today, each claim with where it stands, and a plain list of what we do not claim yet.

[Security Overview](https://salexhub.com/legal/security) · [Report a vulnerability](mailto:start@salexhub.com?subject=Security)

## Each claim, with its evidence.

- **Each customer's data is kept apart.** Every read and write is scoped to the customer of the person or key making it. Database row-level security, which returns nothing to a query without a customer, runs in staging and is next for production. (Scoped in the data-access layer: live; Row-level security: in staging)
- **People see what their role allows.** Roles, field-level restrictions and sharing decide who sees and edits what. A property can be editable for one role, masked for another and absent for a third. (Roles and field access: live)
- **Every act is on the record.** Administrative and agent acts are logged with who, when, what and from where, and refused attempts are logged too. (Audit log: live)
- **Credentials stay sealed.** Mailbox passwords and other stored secrets are encrypted with a key held outside the database. Passwords are hashed with bcrypt, and files are served through signed links that expire in 60 seconds. (Encryption and hashing: live)
- **The Agent never has more than its person.** The Agent works with the permissions of the person it works for, changes come as cards to approve, and an API key never holds more than its creator. (Permissions and approvals: live)

## What we do not claim yet.

Stated plainly, as the Security Overview states it.

- We do **not** hold SOC 2 or ISO/IEC 27001 certification. Our infrastructure providers do, and their reports are available from them.
- We have **not** commissioned an independent third-party penetration test to date.
- We do **not** operate a 24/7 staffed security operations centre.
- We do **not** offer a contractual uptime commitment; enterprise service levels are agreed separately.
- Changes are **not** yet required to pass a second person's review or the automated gates before they are released.
- Our recovery procedure has **not** yet been exercised in a restore drill, and recovery point and recovery time objectives are **not** yet defined.
- Database row-level security is switched on in staging but **not** yet in production; isolation there rests on the data-access layer.
- Default retention periods are **not** yet enforced automatically: the scheduled housekeeping that would enforce them is not running.
- Every organization's data is stored in the European Union. The product records a data region for each organization, but **only the EU region is provisioned**, and a customer cannot choose another yet.

## Read more

- [Security Overview](https://salexhub.com/legal/security): The document a security questionnaire is answered from.
- [Data Processing Agreement](https://salexhub.com/legal/dpa): How we process personal data on your behalf.
- [Subprocessors](https://salexhub.com/legal/subprocessors): Who hosts and processes data for us, and where.
- [Privacy Policy](https://salexhub.com/privacy): What we collect about you, and why.

---

The same page for people: https://salexhub.com/security. Index of this site for agents: https://salexhub.com/llms.txt