Security
What your security team will want to know
The short version: a connector is a Docker image, you choose where it runs, and you own it permanently — source in your repository, no licence check, nothing that switches off. If we run it, we are a data processor and we will say so and sign a DPA. If you run it, nothing of yours reaches us. The longer version, including what we do not have, is below.
Questions and answers
- Where does the connector run?
- Your choice, and it is reversible. On our cloud (Hosted, Integrated), or on your own infrastructure including on-premise (Self-hosted). It is the same Docker image either way, so moving is a redeploy rather than a rebuild.
- Does our data pass through your systems?
- At Hosted and Integrated, yes — in transit. The connector extracts on our infrastructure and writes to your warehouse; nothing is retained after a successful run. At Self-hosted, no: nothing of yours reaches us at all.
- Are you a data processor?
- At the hosted levels, yes, and we will sign a DPA on that basis. At Self-hosted, no — we are not in the data path. We would rather you knew which of those you are buying before your review starts than after.
- Who holds our credentials?
- At Hosted, we do, in our secret manager. At Integrated and Self-hosted, you do — the connector resolves them at runtime from your secret manager or identity provider, and we hold nothing long-lived.
- What happens if we leave, or you disappear?
- You keep everything, and it keeps running. The connector is yours permanently, source in your repository. The SDK it is built against is yours too — the version you hold at the end is free to use, as-is, indefinitely. What ends is what was never in the container: our monitoring, our on-call, and updates as your vendor changes their API. Nothing switches off and there is no licence check in the image. That is true for scheduled and webhook connectors alike.
- Can we start hosted and move it in-house later?
- Yes, and that is the intended path. Same image, same code, different place to run it. Nothing about the connector needs us to exist while you are a customer or after — no licence check, no call home, no control plane. Moving is a redeploy.
- Who can deploy into our environment?
- Whoever you allow. The repository is yours; we work through pull requests, and if you want your own CI to be the only path to production, that is how we set it up.
- How do we revoke your access?
- Our engineers hold named individual identities — never a shared service account — with least-privilege, time-bounded access. Revoke them and, at Self-hosted, nothing stops running.
- Where does data reside at the hosted levels?
- In the region we agree before the build, and only in transit. Ask us for the specifics for your case in writing before you contract — this is a commitment we should be making explicitly, not implying.
- Are you ISO 27001 or SOC 2 certified?
- No, and we will not pretend a certification programme is imminent. That matters more at the hosted levels than at Self-hosted, and if your process requires one we are the wrong supplier for the hosted option.
- Do you carry professional indemnity and cyber insurance?
- This is being arranged and is not yet in place. Ask us for the current position before you contract — we will give you the honest answer, not a policy number that does not exist yet.
- How are hosted tenants isolated from each other?
- Each customer's connectors run as separate workloads with separate credentials and separate destinations. Ask us to walk your team through the specifics; this is the part of the hosted option that deserves the most scrutiny and we would rather you applied it.
- What is logged, and does our data appear in it?
- Run status, duration, row counts, freshness and error messages. Payload data is never logged at INFO. At Self-hosted the logs never leave your project at all.
- Can our security team read the code?
- Yes, all of it. The connector is your code, in your repository, from the first commit — at every level, including hosted. The SDK it is built against is there too, and it is deliberately small enough to read. Review it, fork it, have a third party audit it. There is no compiled component you cannot inspect and no licence check to find.
- What exactly do we own, and what are we paying for?
- You own the connector and the SDK it is built against, permanently and unconditionally — everything in the container is yours. What you pay for is maintenance: while you are under contract we keep the connector working as your vendor changes their API, and we keep the SDK current. When the contract ends you keep everything you have and it keeps running; you stop receiving the next version. The one thing that is ours is the controller, if you take support — it runs in your cluster under licence, and an expired licence still deploys, still manages connectors and still reports status. It is not a switch.
- Is personal data in scope?
- Often yes — HR datasets like Employees or Absences are personal data. At the hosted levels that makes the DPA and the residency question material rather than theoretical. Get your own advice; we will answer factual questions about the architecture.
Posture, plainly
Including the gaps
A page with only good news gets discounted, and it should be. Here is the whole picture.
| Concern | Hosted | Integrated | Self-hosted |
|---|---|---|---|
| Runs on | Our cloud | Our cloud | Your infrastructure |
| Your data on our infrastructure | In transit | In transit | Never |
| Retained after a successful run | No | No | n/a |
| Data lands in | Your warehouse | Your warehouse | Your warehouse |
| Source API credentials held by | Us | You | You |
| Observability | Ours | Your tooling | Yours |
| We are a data processor | Yes | Yes | No |
| DPA offered | Yes | Yes | Not needed |
| Connector source in your repository | Yes | Yes | Yes |
| You own the connector, permanently | Yes | Yes | Yes |
| SDK maintained under contract, yours as-is afterwards | Yes | Yes | Yes |
| Licence check or kill switch in the image | No | No | No |
| Scheduled connector keeps running after the term | Yes | Yes | Yes |
| Webhook ingress after the term | Licensed | Licensed | Licensed |
| Move to another level later | Redeploy | Redeploy | Redeploy |
What we do not have
| ISO 27001 | No. Matters most if you choose a hosted level |
|---|---|
| SOC 2 | No |
| Professional indemnity / cyber insurance | Being arranged. Not yet in place |
| Penetration test report | None yet |
| Written data-residency commitment | Agreed per engagement, not yet a published policy |
| Documented tenant-isolation model | Exists in practice; not yet written up for review |
| Written exit path for a webhook connector | Not yet. A scheduled connector needs none — ask before contracting a webhook one |
Why the answers are short
How much of us you take is your decision
Most vendor risk questions here are answered by the deployment level you pick, not by controls we assert.
The artifact is portable, so nothing switches off
A connector is a Docker image with its source in your repository. There is no licence check, no call home and no control plane — if there were, none of the rest of this page would be true. Start with us running it and move it in-house later, or take the image on day one. Moving is a redeploy of the same container.
You can choose to keep us out of the data path entirely
At the self-hosted level nothing of yours reaches us: no data, no credentials, no logs. That is the version of this offer with the smallest possible vendor surface, and it costs you the convenience of us operating it rather than costing you the connector.
Where we do hold data, we say so
At Hosted and Integrated your data is extracted on our infrastructure before it reaches your warehouse. That makes us a processor. We will sign a DPA, name the region, and walk your team through how tenants are separated. What we will not do is describe a hosted service using language that implies we hold nothing.
You can read the connector's code
It is in your repository under your branch protection, at every level including hosted. Your team can review it, your auditor can read it, and you do not have to take our word for how it handles credentials or errors. Very few suppliers can offer this.
What you own and what you licence are different things
You own the connector — the integration logic, source API handling, incremental state, the transformation, the load. Permanently, unconditionally. The SDK it is built against provides health, metrics, traces and configuration; it is deliberately small, it is in your repository, and we keep it current while you are under contract. When a contract ends every connector carries on unchanged and the SDK version you hold stays yours, as-is and free to use; what stops is our monitoring, our on-call and updates, none of which were ever inside the container. A perpetual licence is purchasable if you would rather not carry the question.
Send us your questionnaire
If there is a specific control you have to evidence, ask. We will tell you whether we meet it, and say no where we do not — that answer is faster and more useful than a brochure.
Ask us