Security

Architecture Security

Multi-Tenant Isolation

Every customer’s data is isolated at the database level through Row-Level Security (RLS). Every database query is automatically filtered by your company identifier, ensuring no customer can access another customer’s data under any circumstances. This isolation is enforced at the PostgreSQL level, providing a mathematically provable boundary between tenants.

Defense in Depth

Our security model implements multiple layers of protection:

• Network Security: AWS VPC with private subnets, security groups, and network ACLs.
• Application Security: Input validation on all endpoints using Pydantic schemas, rate limiting to prevent abuse, and CORS policies restricting cross-origin access.
• Data Security: Encryption at rest (AES-256) and in transit (TLS 1.2+), with secure credential storage through AWS Secrets Manager.

Authentication and Access Control

Authentication

LicenseIQ uses JWT (JSON Web Token) authentication with short-lived access tokens (15-minute expiry) and longer-lived refresh tokens (7-day expiry). Passwords are hashed using bcrypt via the passlib library. The platform enforces strong password requirements and supports secure session management.

Role-Based Access Control

Three permission tiers control access throughout the platform:

• Admin: Full access to all features, data, and settings.
• Manager: Elevated permissions for team operations. Department-scoped restrictions and finer-grained role templates are available under design-partner engagement.
• Employee: View own data and submit access requests.

Each API endpoint enforces role-based permissions, ensuring users can only access data and actions appropriate to their role.

Compliance

Enterprise-grade encryption and audit logging

LicenseIQ operates on enterprise-grade security primitives. All customer data is encrypted at rest in AWS RDS using an AWS-managed key. OAuth credentials for third-party integrations are encrypted at the application layer using AES-256-GCM authenticated encryption, with an environment-managed key. Administrative and AI-initiated changes are captured in a row-level audit log with before/after state, alongside per-request access monitoring. Multi-tenant isolation is enforced at the database layer using row-level security (RLS), ensuring customer data never crosses tenant boundaries. Application secrets are stored in AWS SSM Parameter Store as KMS-encrypted parameters, and the database credential is held in AWS Secrets Manager with automated rotation. We continue to invest in additional certifications as we grow.

GDPR Readiness

We’re building toward full GDPR coverage. Our current foundation supports the controls customers need under design-partner engagement:

• Audit-ready data inventory — every record carries the per-tenant metadata required to support data subject access requests.
• Soft-delete capability across primary tenant-scoped tables provides the foundation for right-to-erasure workflows under design-partner engagement.
• Export-ready architecture — encrypted at-rest data structured per-tenant. JSON and CSV portability endpoints are available under design-partner engagement.
• Consent capture at signup. Richer consent-flow tracking with timestamps and purpose specification is available under design-partner engagement.
• PII handling via encryption at rest and in transit. Automated PII detection and masking are available under design-partner engagement.

AI Security

Our AI architecture includes specific security measures for artificial intelligence operations:

• All AI tool executions require two-phase confirmation for write operations, preventing unintended modifications.
• Company Data sent to AI providers (Anthropic, OpenAI) is transmitted over encrypted connections and is not used to train provider models under our API agreements.
• AI-generated recommendations are informational and require human approval before execution of any data-modifying actions.
• Conversation context is isolated per company through our multi-tenant memory system.

Infrastructure Security

LicenseIQ runs on Amazon Web Services (AWS) infrastructure, leveraging AWS’s world-class physical and network security:

• ECS Fargate: Serverless container orchestration (no server management surface).
• RDS PostgreSQL: Automated backups and encryption.
• ElastiCache Redis: Caching with encryption in transit.
• S3: Server-side encryption for document storage.
• CloudWatch: Centralized logging and monitoring.
• Secrets Manager: Secure credential storage.

All infrastructure is defined as code (Terraform), ensuring reproducible, auditable deployments.

Monitoring and Incident Response

We maintain 24/7 monitoring of platform health, security events, and anomalous activity. Our monitoring stack includes application health checks, performance metrics, error rate tracking, and security event logging. Our incident response process follows established procedures for identification, containment, eradication, and recovery, with communication protocols for notifying affected customers.

Vulnerability Management

We conduct regular dependency audits and keep all libraries and frameworks updated. Our CI/CD pipeline includes automated security checks. We welcome responsible disclosure of security vulnerabilities and can be reached at security@licenseiq.net.

Data Handling Practices

• Encryption at Rest: All data stored in our databases and object storage is encrypted using AES-256 encryption managed by AWS.
• Encryption in Transit: All data transmitted between your browser and our servers, and between our internal services, is encrypted using TLS 1.2 or higher.
• Backup and Recovery: Automated daily database backups with point-in-time recovery capability. Backups are encrypted and stored in a separate AWS region.
• Data Deletion: When you delete data or close your account, we permanently remove your Company Data within 30 days. Audit logs may be retained for compliance purposes.

Contact

For security inquiries, vulnerability reports, or to request our detailed security documentation: