Security Built for Crisis-Sensitive Data

Defusely stores sensitive incident data — internal conversations, legal opinions, draft responses, and executive decision records. That’s why security isn’t a feature. It’s the foundation.

Encryption

In Transit

All data moving between your browser and Defusely servers is encrypted with TLS 1.3. Every API request, every file upload, every response draft travels over an encrypted channel.

At Rest

Sensitive fields (draft responses, internal comments, legal notes) are encrypted with AES-256-GCM at the database level. Encryption keys are stored separately from the data, in a hardened key management service.

Key Management

Encryption keys are rotated automatically every 90 days. Key access is logged. Lost or compromised keys are rotated immediately, and affected data is re-encrypted without downtime.

Access Control

Defusely uses role-based access control (RBAC) to ensure only the right people see the right data.

Role	War Room Access	Response Drafts	Approvals	Audit Trail
Editor	Create, edit, close	Create, edit	Submit for approval	Full visibility
Approver	View, contribute comments	Review, approve/reject	Approve or reject	Full visibility
Viewer	Read-only	Read-only	None	Full visibility

Per-Brand Isolation

For multi-brand agencies: data from Brand A is invisible to Brand B. A user with access to Brand A cannot see or access any workspace, War Room, or incident record from Brand B. This isolation is enforced at the database level, not the application layer.

Audit Trail

Every action in a War Room is logged with a timestamp, actor, and change. This includes:

• Who created the War Room and when
• Who edited the draft response (each version, each change)
• Who approved or rejected the response
• Who closed the incident and marked it resolved
• Any additions or edits to severity scores, approvals, or comments

Logs are immutable: they cannot be edited or deleted. They can be exported as a PDF for legal review, board reporting, or compliance audits.

Infrastructure

Encrypted Database

All customer data lives in encrypted PostgreSQL databases. Backups are encrypted both in transit and at rest. Database access is restricted to specific service accounts with least-privilege permissions.

Network Isolation

Defusely infrastructure runs on isolated virtual private clouds (VPCs). No direct internet routes into the application except through our API gateway. Internal services communicate over encrypted private networks.

DDoS Protection

Cloudflare sits in front of our API and web servers, providing DDoS mitigation, rate limiting, and automated bot detection.

Uptime Monitoring

Systems are monitored 24/7 with automatic failover. If a server fails, traffic routes to healthy instances immediately.

Input Validation & Data Handling

We Validate

• All user inputs are validated on both client and server
• File uploads are scanned for malware and executable content
• Comment text is sanitized to prevent XSS and injection attacks
• API requests are rate-limited to prevent brute-force and scraping attacks

We Never Store

• Passwords are hashed with bcrypt and salted. We never see or store plain-text passwords
• Credit card information is not stored — payments go directly to Stripe
• API keys and OAuth tokens are encrypted and never logged
• User session tokens are short-lived and invalidated on logout

Compliance & Standards

Defusely is designed to meet or exceed enterprise compliance requirements.

Standard	Status	Details
SOC 2 Type II	Certified	Annual third-party audit of security controls, change management, and availability
GDPR	Compliant	Data processing agreements, right to erasure, data portability, privacy by design
CCPA	Compliant	California privacy rights including opt-out, deletion, and data disclosure
HIPAA	Available	Business Associate Agreements for healthcare customers upon request
ISO 27001	In progress	Information security management system certification underway

Questions About Security?

If your team has specific security requirements, compliance questions, or need to evaluate Defusely for your procurement process, let’s talk.

Contact our security team