Security you can check,
not security you have to believe.
Immistack holds passports, police checks, medical records and the correspondence that decides whether someone can stay in a country. This page states what protects that data, and what does not exist yet. Both halves matter when you are the one signing.
What we do not have
Immistack holds no SOC 2 report and no ISO 27001 certification today. There is no independent audit to send you and no attestation letter behind this page. If a formal certification is a hard requirement in your procurement process, we do not meet it, and you should know that here rather than at the end of a pilot.
What exists instead is architectural, and it is the part a certification would examine: isolation enforced by the database rather than by application code, an append-only hash-chained audit trail, and a fail-closed rule that no privileged access happens unless it can first be recorded. Those are described in full below and we will walk a reviewer through them.
Likewise, no regulator integration is live. Every one of them is sandbox. That is a licensing position, not a technical one, and we say so on every response the platform returns.
Tenant isolation, enforced by the database
- Every tenant-scoped table has Postgres row-level security switched on with both ENABLE and FORCE, so the policy applies to the table owner as well as to ordinary callers.
- The application connects as a dedicated role that does not hold BYPASSRLS. A query that tries to read across a firm boundary returns nothing, whatever the application code intended.
- The tenant identity is bound to the same pooled connection that runs the query. If it cannot be set, the connection is released and the request fails rather than proceeding unscoped.
- Isolation is verified the way an attacker would test it — one firm’s credentials pointed at another firm’s records, over HTTP, against a running system.
An audit log that cannot be quietly rewritten
- The audit log is append-only, enforced by database triggers rather than by application code that could be bypassed.
- Entries are hash-chained: altering or removing one breaks the chain, and the break is visible.
- Any cross-tenant access by platform staff writes a CRITICAL entry before the work begins.
- That write is fail-closed. If the audit entry cannot be recorded, the access does not happen — there is no path that performs the work and skips the record.
How your data is handled
- TLS for all data in transit, between your browser and the platform and between the platform and its own services.
- AES-256 encryption at rest for the database and for stored documents.
- Per-tenant row-level isolation at the storage layer, not merely a tenant column that the application promises to filter on.
- Document and file access is decided by a single access-control service shared by every read path. A document you may not read returns "not found" rather than "forbidden", so the existence of another client’s file is not disclosed.
Regulator integrations are sandbox
All eight regulator adapters ship in sandbox mode. Production wiring is pending accreditation with each authority, which is a licensing process rather than an engineering one.
Sandbox unless proven otherwise
An adapter goes live only when a live mode is deliberately requested and real credentials are present. Either one alone leaves it in sandbox, on purpose: a missing credential can only ever mean "not licensed yet", and the safe reading of that is never to aim a real request at a government system.
Every response says where it came from
Each regulator response carries provenance — a sandbox flag, the adapter, the authority, a request id, latency and the time it was retrieved. A sandbox result cannot be mistaken for a live one in the interface or in an export, and a failed lookup is returned as a failure rather than as an empty success.
Payment card data never touches us
Immistack does not store, transmit or log a card number, a CVV or an expiry date. Nothing in the product accepts one. Firms record what a client has settled against a matter; the settlement itself happens outside the platform. There is no card field to leak, and no card record to subpoena.
Reviewing us for your firm?
Send us your security questionnaire. We would rather answer "no, not yet" in writing than have you find it out later. Report a suspected vulnerability to the same address and we will acknowledge it.