Security

SimpleSecurity runs exclusively in a single AWS region. We don't replicate customer data to other regions or providers.

• Hosted entirely in AWS eu-north-1 (Stockholm, Sweden)
• EU data residency for all customer data
• GDPR-scoped hosting under AWS's EU Data Processing Addendum
• No secondary region or non-EU backup copy of customer data

The platform is fully serverless: AWS Lambda for compute, DynamoDB for data, S3 and CloudFront for the frontend. There are no servers of ours to patch, no SSH access, and no standing compute that can be left misconfigured or unpatched.

• Compute: AWS Lambda functions, invoked per request
• Data: DynamoDB, on-demand, no managed servers
• Frontend: S3 + CloudFront, no origin servers exposed
• No SSH, no long-running instances, no OS patching surface

Tenant isolation: every DynamoDB table is partitioned by tenant_id. Every API request resolves its tenant server-side from the authenticated identity — never from a value the client supplies. Because each database query is tenant-keyed at the query level, there is no code path in the API that can read across tenants without also changing the authenticated identity making the request.

Data is encrypted at rest by default, replicated across multiple availability zones within Stockholm, and recoverable to a specific point in time.

• DynamoDB encrypted at rest (AES-256), enabled by default
• S3 encrypted at rest (AES-256), enabled by default
• Point-in-time recovery enabled on DynamoDB
• Data replicated across multiple availability zones within Stockholm
• All traffic is encrypted in transit over HTTPS

Every request reaches us through CloudFront, in front of AWS's managed edge protections.

• AWS Shield Standard DDoS protection on every edge endpoint
• HTTPS enforced on all traffic — HTTP requests are redirected
• Backend APIs reject unauthenticated requests — there is no anonymous read or write path to customer data

Authentication is handled by AWS Cognito. Your password never touches our application code.

• AWS Cognito user pool for authentication
• Optional TOTP multi-factor authentication
• JWT-based sessions
• Role and group-based permissions per service
• Narrowly scoped IAM policies per DynamoDB table (e.g. a dedicated read-only policy for dashboard reads)

Control-plane activity and application behavior are both logged.

• AWS CloudTrail records all control-plane API activity (multi-region trail)
• CloudWatch logs and metrics on every function
• SNS alerting topics for operational alerts

Billing is handled entirely by Stripe. Card data never touches our systems — we never see, store, or process it.

SimpleSecurity runs on AWS infrastructure that is ISO 27001 and SOC 2 certified. SimpleSecurity itself is pre-certification — our own SOC 2 / ISO 27001 program is on the roadmap. We'd rather say that plainly than imply a certification we don't hold.