> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> The controls the platform enforces today, in one table, with what is not available and what is planned kept apart.

This page lists what the software does. Policies, reviews and certifications are not on it. For the security policy, email [contact@deepblocker.ai](mailto:contact@deepblocker.ai).

## What the platform enforces

| Area | What is in place |
| - | - |
| **Encryption** | Data is encrypted in transit (TLS) and at rest |
| **Sign-in** | Email and password, or Google. Password reset by email, with the same reply whether or not the address is known |
| **Administrator sign-in** | Administrator sign-in can require a second factor. When it does, an administrator action is refused unless the session was opened with one |
| **Sessions** | You stay signed in until you sign out. There is no idle timeout |
| **Roles** | Owner, admin, member. Owners and admins invite, resend, revoke and remove. Nobody can remove the owner |
| **Invites** | A single-use link, valid for 7 days, that only works for an account with the matching email address |
| **Workspace separation** | Every record carries its workspace. The server checks it on each request, and the database rules stop a browser reading another workspace's data |
| **Campaign authorisation** | A launch needs a named authoriser, their email, a reference and a scope confirmation. The server refuses a launch without them |
| **Kill switch** | One switch stops every campaign in the workspace |
| **Consent links** | The link token is never stored, only its hash. Links expire after 7 days and can be used once |
| **Incoming webhooks** | Signatures from Stripe and Vapi are verified before a message is acted on |
| **Outgoing result webhooks** | Sent to HTTPS addresses only. They are not signed |
| **Agent connection** | Each message to your agent carries a signature over the method, path and body, valid for 300 seconds |
| **Agent Assurance evidence** | Each record is encrypted with its own key. That key is encrypted with a master key held only as a server setting. Each record and each test run has a SHA-256 fingerprint, and the campaign page says if a record has changed |
| **Auditor pack exports** | Every export is logged |
| **Error tracking** | Phone numbers, emails and keys are scrubbed before an error report is sent. Audio and transcripts are never sent |
| **Model training** | Your data is not used to train our providers' models |

## Not available

| Feature | Status |
| - | - |
| Second factor for customer accounts | Not available |
| Single sign-on (SAML, OIDC, Microsoft) | Not available |
| User provisioning (SCIM) | Not available |
| Retention setting in the console | Not available. See [Retention and deletion](https://docs.deepblocker.ai/trust/retention.md) |
| Self-service data export or account deletion | Not available. Both by email. See [Your requests](https://docs.deepblocker.ai/trust/requests.md) |

> [!NOTE]
>
> **Planned.** We align our controls to ISO 27001 and NCSC good practice. We are an early-stage company and are not yet certified. A Cyber Essentials self-assessment and an independent penetration test are planned.

> [card] [Where your data lives](https://docs.deepblocker.ai/trust/data-residency.md)
>
> The two deployments and the regions.

> [card] [Legal documents](https://docs.deepblocker.ai/trust/legal.md)
>
> The security policy and the other documents on request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.