Platform / Security
Architecture designed for SOC 2 compliance, with encryption at rest and in transit, role-based access control, and comprehensive audit logging.
Compliance Roadmap
We believe in honesty about our compliance journey. Here is exactly where we stand and where we are headed.
Actively pursuing SOC 2 Type II certification with an independent auditor. Architecture and controls are designed to meet all five Trust Service Criteria: security, availability, processing integrity, confidentiality, and privacy.
Platform architecture is designed for GDPR compliance with built-in data residency controls, consent management, right-to-erasure workflows, data portability exports, and Data Processing Agreements for all customers.
Infrastructure is designed with HIPAA technical safeguards in mind: encryption, access controls, audit logging, and BAA availability. Intended for healthcare and life sciences customers on Enterprise plans.
ISO 27001 certification is on the security roadmap as part of expanding international compliance coverage. Information security management system design is underway.
Encryption
Every layer of the stack enforces encryption. Your content is protected from storage through delivery.
All content, assets, and metadata are encrypted at rest using AES-256 encryption. Database storage, file storage, and backups all use the same encryption standard with automatic key rotation.
All API traffic, webhook delivery, and asset serving enforces TLS 1.3. Older TLS versions are rejected. HSTS headers are set with long max-age values to prevent protocol downgrade attacks.
Enterprise customers can bring their own encryption keys (BYOK) managed through AWS KMS, Google Cloud KMS, or Azure Key Vault. Key access is logged and auditable. Revoking a key renders all encrypted data unreadable.
Sensitive content fields can be individually encrypted with dedicated keys, providing an extra layer of protection for PII, financial data, or regulated content beyond the default storage encryption.
Access Control
Control who can access what, down to individual content fields. Integrate with your existing identity provider and enforce your organization's security policies.
Single sign-on via SAML 2.0 and OpenID Connect (OIDC). Integrate with Okta, Azure AD, Google Workspace, OneLogin, Auth0, and any standards-compliant identity provider. Enforce MFA at the IdP level.
Define custom roles with granular permissions down to individual content fields. Control who can create, read, update, delete, publish, and approve content across content types, environments, and locales.
Generate scoped API keys with specific permissions, rate limits, and expiration dates. Keys can be restricted to specific content types, read-only access, or specific IP ranges. Rotate keys without downtime.
Restrict CMS admin access and API calls to specific IP addresses or CIDR ranges. Useful for enterprise environments where access should only originate from corporate networks or approved VPNs.
Audit & Monitoring
Comprehensive audit logging and real-time monitoring give you full visibility into who did what, when, and from where.
Every action — content changes, permission updates, API calls, login events, configuration changes — is recorded in an append-only audit log. Logs cannot be modified or deleted, even by administrators.
Configure alerts for security-relevant events: failed login attempts, permission escalation, API key creation, bulk data exports, or unusual access patterns. Alerts are delivered via email, Slack, or webhooks.
Export audit logs in standard formats (JSON, CSV) for ingestion into your SIEM or compliance reporting tools. Scheduled exports can be delivered to S3, GCS, or Azure Blob Storage automatically.
Generate compliance reports showing access patterns, permission usage, data handling practices, and security posture over configurable time periods. Designed for auditor review and regulatory submissions.
Data Residency
Choose where your content data lives. Meet data sovereignty requirements and serve content from regions that align with your regulatory obligations.
Select your primary data storage region from available options including US, EU, and Asia-Pacific. Data at rest remains in your selected region while edge caches serve content globally.
Configure rules that prevent content data from leaving specified geographic boundaries. Useful for organizations subject to GDPR, PDPA, LGPD, or other regional data protection regulations.
For disaster recovery and high availability, configure replication to a secondary region. Replication respects data residency rules and only replicates to regions you explicitly approve.
Export all your content, assets, and configuration in standard formats at any time. No lock-in. Your data is always yours, and you can move it to another platform without vendor assistance.
Talk to our security team about how CuberIQ meets your organization's compliance and data protection needs.