Security - DeepBlocker Docs

This page lists what the software does. Policies, reviews and certifications are not on it. For the security policy, email contact@deepblocker.ai.

What the platform enforces

Area	What is in place
Encryption	Data is encrypted in transit (TLS) and at rest
Sign-in	Email and password, or Google. Password reset by email, with the same reply whether or not the address is known
Administrator sign-in	Administrator sign-in can require a second factor. When it does, an administrator action is refused unless the session was opened with one
Sessions	You stay signed in until you sign out. There is no idle timeout
Roles	Owner, admin, member. Owners and admins invite, resend, revoke and remove. Nobody can remove the owner
Invites	A single-use link, valid for 7 days, that only works for an account with the matching email address
Workspace separation	Every record carries its workspace. The server checks it on each request, and the database rules stop a browser reading another workspace’s data
Campaign authorisation	A launch needs a named authoriser, their email, a reference and a scope confirmation. The server refuses a launch without them
Kill switch	One switch stops every campaign in the workspace
Consent links	The link token is never stored, only its hash. Links expire after 7 days and can be used once
Incoming webhooks	Signatures from Stripe and Vapi are verified before a message is acted on
Outgoing result webhooks	Sent to HTTPS addresses only. They are not signed
Agent connection	Each message to your agent carries a signature over the method, path and body, valid for 300 seconds
Agent Assurance evidence	Each record is encrypted with its own key. That key is encrypted with a master key held only as a server setting. Each record and each test run has a SHA-256 fingerprint, and the campaign page says if a record has changed
Auditor pack exports	Every export is logged
Error tracking	Phone numbers, emails and keys are scrubbed before an error report is sent. Audio and transcripts are never sent
Model training	Your data is not used to train our providers’ models

Not available

Feature	Status
Second factor for customer accounts	Not available
Single sign-on (SAML, OIDC, Microsoft)	Not available
User provisioning (SCIM)	Not available
Retention setting in the console	Not available. See Retention and deletion
Self-service data export or account deletion	Not available. Both by email. See Your requests

Planned. We align our controls to ISO 27001 and NCSC good practice. We are an early-stage company and are not yet certified. A Cyber Essentials self-assessment and an independent penetration test are planned.

Where your data lives

The two deployments and the regions.

Legal documents

The security policy and the other documents on request.