Snapshot 113031
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Security & Trust Security, Built for How We Actually Operate Pretectum CMDM is built for teams that need one trustworthy customer record without an enterprise-sized security program to go with it. Here’s exactly how access, encryption, and data handling work today — what’s solid, what’s on our roadmap, and who to talk to if you have questions. Contact Our Security Team Compliance Posture Our Approach Security Philosophy Least privilege is the standard we design toward. But we’re honest about what running a small, SMB-focused company actually looks like day to day: the same few people often carry more than one responsibility, and a security program too heavy to operate doesn’t protect anyone. Ownership today is shared between engineering and our founder, who stays closely involved across the platform. Our senior architect has the authority to make changes as soon as an issue is identified — fixes don’t wait on a committee. A shared mailbox routes anything that needs attention to the right person. Our goal is security that’s substantial enough to earn your confidence — your data secured, protected, and not needlessly exposed — without demanding an implementation burden your team, or ours, can’t absorb. As we grow, this will formalize further; for now, accountability sits with named people, not process for its own sake. Where Your Data Lives Infrastructure & Hosting Pretectum CMDM runs entirely on Amazon Web Services (AWS) — no on-premise component, and no second cloud provider hosting core platform data. Multi-Tenant, Logically Isolated Serverless, AWS-Native Architecture Tenants share infrastructure by default and are logically isolated — every request is scoped by tenant and permission context, enforced by dedicated tenant and permission services, rather than by physically separate databases or compute per customer. Dedicated, single-tenant deployment can be discussed for larger customers with that requirement, though it isn’t a standard offering today. API & AuthenticationAPI Gateway handles every REST endpoint; Cognito manages authentication with a Lambda Authorizer validating JWTs on each request. ComputeECS/Fargate runs containerized, auto-scaling services alongside 16+ purpose-built Lambda microservices (tenant, dataset, permission, schema, CDC, and more). Data LayerDynamoDB holds core entities with streams enabled; Aurora DSQL (PostgreSQL-compatible) syncs for structured querying; ElastiCache (Redis) handles session, permission, and query caching. Events, Storage & MonitoringKinesis and SQS drive lineage and lifecycle events; S3 stores uploads and exports; SES sends notifications; CloudWatch monitors it all. Optional integrations sit outside the core platform: Google (customer-enabled address verification only) and OpenAI (bring-your-own-license, opt-in AI actions only). See Sub-Processors below. Data Protection Encryption Encryption at Rest AES-256 encryption across DynamoDB, Aurora DSQL, S3, and ElastiCache, using AWS-managed encryption. Encryption in Transit All traffic is encrypted via TLS using SSL certificates — from client to API Gateway, and between internal services. Key Management AWS-managed KMS keys today. Customer-managed keys aren’t currently offered; an area we’ll revisit as demand grows. Layered, Self-Configurable Access Control Access is layered, and every layer is configurable by the tenant itself — not fixed by us. Tenant Your Organization The first user to log in becomes the default tenant administrator; every user after that starts as a plain Member with minimal permissions until explicitly granted more. Role Object-Level Permissions A fully self-configurable permission matrix — Add / View / Edit / Delete toggles, independently set for every object type. Business Area Data Segment A departmental or divisional data boundary within the tenant. Users must be explicitly assigned — access is never implied by tenant membership alone. User Grant Per-Person CRUD Within an assigned Business Area, each user gets their own explicit Add / View / Edit / Delete permissions, layered on top of their role. Field-Level PII Masked by Default Attributes designated PII at the schema level are masked automatically, everywhere. Unmasking requires an explicit permission and a re-authentication step, and every reveal is logged. Authentication today is username and password through Cognito. SSO/SAML and MFA aren’t available yet — both are on our roadmap, prioritized by customer demand. If this is a requirement for you, tell us; it’s exactly the kind of signal that moves our roadmap. Internal access: Pretectum engineering has no access to customer data. Our internal Admin Console — restricted to pretectum.com staff credentials — is limited to tenant and account administration: tenant metadata, users, subscription status, and lifecycle actions. It does not expose customer records, schemas, or data of any kind. Retention & Erasure Data Handling and Retention Individual records: deleting a record — including in response to a Data Subject Access Request (DSAR) for erasure — is self-service, governed by the same permission model above. Any user with delete rights on an object can act on it directly. How DSAR erasure actually works: the record is removed from the Golden Nominal store and marked deleted immediately, logged with the rationale tied back to the originating DSAR request. It isn’t physically wiped in that instant — it’s rendered inaccessible right away, and the underlying data is fully purged after a 90-day cycle. Record reinstatement isn’t a first-class feature: recovering a deleted record means creating a new one with a new identity, not undoing the original. Tenant offboarding follows the same pattern. Disabling a tenant requires typing the exact tenant name to confirm, and is fully reversible if a customer wants to return. Deleting a tenant moves its data to a staging area; a batch process performs final, irreversible deletion after the same 90-day cycle. The harder DSAR problem is data already syndicated to other systems. Pretectum can generate a report identifying where deletion is recommended downstream, and — where a customer has invested in the integration — can programmatically delete matching records using their external keys. We don’t have, and can’t promise, reach into every system a customer might sync data to. Where We Stand Today Compliance and Certifications SOC 2 / ISO 27001 Not certified today. We haven’t pursued SOC 2 Type I/II or ISO 27001 yet — we’ll prioritize this as our customer base requires it. AWS-Inherited Assurance We run entirely on AWS, which maintains its own SOC 2, ISO 27001, and PCI DSS certifications for the infrastructure layer. That’s inherited infrastructure assurance, not a Pretectum certification — application-level practices remain our own responsibility. DPA, HIPAA & BAA Not yet formalized. This reflects where our current customer base sits today, not a permanent position — if you need one of these, tell us. DSAR & Consent Support Native support for erasure requests, audit-logged PII reveals, and reporting for data that’s been syndicated to other systems. A Process We’d Actually Follow Incident Response We don’t have a large security team, so our process is intentionally lightweight rather than theoretical. 1 Detection Any suspected issue, from any source, is logged as a tracked ticket immediately. 2 Triage Founder and/or senior architect assess severity and scope, targeting a 72-hour turnaround. 3 Response Engineers coalesce around the ticket to investigate and remediate; the architect can make immediate changes. 4 Notification If a confirmed incident affects customer data, affected tenants are notified without undue delay. 5 Follow-Through Root cause is recorded, and if it points to a needed change, that becomes a concrete action, not just a note. Kept Short By Design Sub-Processors and Third Parties Provider Role Customer Data Involved? AWS Core infrastructure — compute, storage, database, caching, notifications (SES), monitoring (CloudWatch) Yes — this is the platform Google Optional, customer-enabled address verification only Only if a customer enables the feature OpenAI Optional AI actions, bring-your-own-license Only with a customer-supplied license; data is anonymized/tokenized before use, not sent raw No billing or payment processor is in use today — we’ll update this page when that changes. Have a Security Question or Found Something? Contact us directly at security@pretectum.com. We don’t run a formal bug bounty program today, but we take every report seriously and respond promptly — please give us a reasonable window to investigate before disclosing anything publicly. Email Security Team Explore the Platform Scroll to Top