Snapshot 128847
Normalized text
Scripts and page chrome removed; this is what change detection compares.
NewPermit Nexus PDP benchmarks: 5.6 ms P99 on RBAC checks, measured server-sideNexus PDP: 5.6 ms P99 RBAC checksSee the benchmarks Independent assurance, practical safeguards Our program combines independently examined controls with security practices designed for cloud, hybrid, and self-hosted authorization. Independently attested SOC 2 Type II Permit.io completed its latest SOC 2 Type II renewal in January 2026. Sections 1–2 are public; the full report is available on request. Compliant HIPAA Administrative, technical, and operational safeguards support HIPAA-regulated workloads. Business Associate Agreements are available where applicable. Compliant GDPR Permit.io supports data subject rights, contractual processing terms, and Standard Contractual Clauses for applicable international transfers. Compliant CCPA / CPRA Privacy procedures support applicable California consumer rights and customer data processing obligations. Hybrid by Design Permit.io’s Edge PDP evaluates authorization close to your application. A local PDP can continue using cached policy during a temporary control-plane interruption, while self-hosted options give customers more control over deployment boundaries. Shared Responsibility Permit.io secures the service and its delivery. Customers remain responsible for policy design, user lifecycle, application integration, and their deployment environment. Hybrid deployment Permit control plane Permit cloud, or self-hosted Policy editor for every team Policy as code in your Git repo Audit views and decision logs OPAL syncs policy and data Your network VPC, data center, or on-prem Policy decision points Run beside your services and gateways. Decisions keep working from cached policy. Your apps and APIs Your gateways Your data Policy is authored centrally and decided locally. Sensitive data stays in your network, and only opaque identifiers need to reach the control plane. Evidence for your security review Review public policies and operating status, or request controlled access to confidential assurance documents. Compliance SOC 2 Type II Report (Sections 1–2) Public management assertion and system description from the latest independent examination. View / download Compliance SOC 2 Type II Full Report Complete independent examination report for qualified customers and prospects. Request this document Security testing Penetration Test Summary Redacted executive summary of the latest independent assessment. Request this document Privacy Data Processing Addendum Contractual privacy and data processing commitments. View resource Privacy Privacy Policy How Permit.io collects, uses, and protects personal information. View resource Reliability Service Status Live availability and incident updates for Permit.io services. View resource Architecture Product Documentation Technical guidance for hosted, hybrid, and self-hosted deployments. View resource Security across the service lifecycle Technical and organizational controls help protect customer data and keep the authorization service dependable. Infrastructure Security Layered safeguards protect Permit.io’s cloud-hosted services. AWS-hosted production environment with VPC isolation Encryption in transit and at rest with managed key controls Multi-Availability Zone database replication and daily backups Centralized monitoring, logging, and on-call alerting Identity & Access Access follows least-privilege and individual-account principles. Multi-factor authentication for critical systems Quarterly access reviews and prompt offboarding Restricted, logged, and reviewed production access Role-based access aligned to job responsibilities Product Security Security checks are integrated throughout the development lifecycle. Protected branches and peer-reviewed changes Automated tests, dependency scanning, and vulnerability scanning Annual independent penetration testing Tenant isolation across organizations, projects, and environments Organizational Security People, process, and endpoint controls reinforce technical safeguards. Annual security awareness and secure-coding training Background and reference checks where permitted Managed endpoints with encryption and anti-malware protection Documented incident response and escalation procedures Data & Privacy Data handling practices support privacy and customer control. Controller and processor responsibilities defined by context Data subject access, correction, deletion, and portability support Retention limited by purpose, contract, and legal requirements At least 14 days’ advance notice for subprocessor changes Continuity & Resilience Hybrid architecture helps authorization remain close to the application. Business continuity and disaster recovery plans Annual backup restoration and recovery exercises Locally deployed Edge PDP can continue evaluating cached policy Public service status and incident communication Service providers that support Permit.io These providers may process customer data while delivering the Permit.io service. Customers receive advance notice of applicable subprocessor changes. ProviderPurpose Amazon Web ServicesCloud hosting DatadogSystem monitoring and logs GoogleAnonymized usage analytics Twilio (Segment)Event management MixpanelAnonymized usage analytics StripeBilling SentrySystem error monitoring Auth0User authentication WorkOSEnterprise single sign-on (SSO) For the contractual list and notice terms, review the Data Processing Addendum. Trust program updates Material assurance and service-provider updates are published here as the program evolves. ComplianceJanuary 2026 SOC 2 Type II Renewal Completed Permit.io completed its latest SOC 2 Type II renewal. Sections 1–2 are available to view and download; qualified customers and prospects can request the full report. View Sections 1–2Request full report Common security questions Quick answers to frequent architecture, privacy, and assurance questions. Does Permit.io encrypt customer data? Yes. Permit.io uses TLS to protect data in transit and encrypts production databases and block storage at rest. Encryption keys are managed through AWS KMS. Can authorization continue during a control-plane interruption? A locally deployed Edge PDP can continue evaluating cached policy and user data if it temporarily loses connection to the Permit.io control plane. Policy updates resume after connectivity returns. Does Permit.io use AI to make authorization decisions? No. Permit.io-owned AI models do not make production authorization decisions. Authorization is evaluated deterministically from the policies and contextual data configured by the customer. Where is customer data processed? Processing location depends on the selected deployment model and contract. Hosted services use AWS, while Edge PDP and self-hosted options let customers keep authorization evaluation closer to their own infrastructure. How can I report a security concern? Email help@permit.io with “Security concern” in the subject. The support team will route the report to the appropriate security owner. Security Review Need more evidence? Tell us which documents your review requires. Our team will verify your request and help with security questionnaires, SOC 2 evidence, penetration testing summaries, or a BAA. Request Security Documents