Snapshot 223378
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security & Compliance When you trust DecisionRules with your business logic, we take that seriously. ISO 27001 certified. SOC 2 Type II audited by BDO. Here's everything you need to complete your vendor security assessment. Contact Us Certifications Certifications & Audits DecisionRules maintains rigorous compliance standards verified by independent auditors. ISO 27001 Certified DecisionRules is ISO/IEC 27001 certified, demonstrating our commitment to information security management. This internationally recognized standard ensures we have systematic processes in place to manage and protect sensitive data. Download certificate SOC 2 Type II Our SOC 2 Type II report was independently audited by BDO, one of the world's largest accounting and advisory networks, independently audited our controls and issued our SOC 2 Type II report. Type 2 means BDO tested how our controls operated over a period of time, not on a single day. Request SOC 2 Type II Report Infrastructure Security Status Monitoring For real-time updates on service availability and operational status, visit our dedicated status page. We maintain transparency about system health and promptly communicate any incidents here. View Status Monitoring Cloud Infrastructure DecisionRules leverages Amazon Web Services (AWS) as our cloud service provider. We offer data hosting across multiple regions including the United States and Europe, allowing you to choose where your data resides. Time Synchronization All systems receive time information from secure, authorized central time servers using Amazon Time Sync Service. This NTP-based service uses redundant satellite-connected and atomic clocks to deliver highly accurate time references with automatic leap second handling. Incident Response DecisionRules maintains documented incident response procedures to ensure rapid detection, containment, and resolution of security events. Our team is trained to respond effectively to potential threats. Application Security Vulnerability Management We maintain a proactive vulnerability management process. All DecisionRules Docker images are automatically scanned using Trivy. Identified vulnerabilities are remediated within a maximum 14-day resolution period. Penetration Testing Annual penetration tests are performed by independent security contractors to identify and address potential vulnerabilities before they can be exploited. Product Security Audit Logging DecisionRules provides comprehensive audit logging capabilities, enabling you to track all changes and access to your business rules for compliance and forensic purposes. View Audit Logs Documentation Multi-Factor Authentication Protect your account with two-factor authentication (2FA), adding an extra layer of security beyond passwords. Role-Based Access Control DecisionRules supports the principle of least privilege through configurable access roles. The platform provides four default user roles (Admin, Editor, Reader) with the ability to create custom roles tailored to your organization's needs. Single Sign-On (SSO) Integrate DecisionRules with your existing identity provider for seamless and secure authentication across your organization. View SSO Documentation Data Security Data Backups DecisionRules ensures data security with robust backup strategies. All data is stored in MongoDB Atlas with automated backup procedures to protect against data loss. Encryption at Rest All databases are encrypted using cloud provider-managed keys, ensuring your data remains protected even at the storage level. Encryption in Transit TLS encryption is enforced across all communication layers within the application, protecting data as it moves between systems. Data Privacy GDPR Compliance DecisionRules is committed to GDPR compliance and protecting the privacy rights of individuals within the European Union. Data Protection Officer DecisionRules has appointed Petr Lev as Data Protection Officer, responsible for advising and monitoring our compliance with GDPR and relevant internal policies. People & Training Security Awareness Training DecisionRules maintains a cybersecurity awareness program requiring all employees to complete security training during onboarding and at least annually. This ensures our team stays informed about the latest threats and best practices. AI Zero Data Retention When you use our built-in AI features, your data is processed transiently and securely. We guarantee that customer data is never stored within our LLM provider's infrastructure. Once a request is processed, the data is immediately discarded, ensuring your sensitive business information remains exclusively yours. No Model Training Your inputs, outputs, and rule definitions are strictly confidential. We have robust agreements in place ensuring that your data is never used to train, fine-tune, or improve our LLM providers' foundational models, keeping your intellectual property completely walled off from public AI ecosystems. On-Premise Flexibility For organizations with strict compliance requirements, our on-premise installation offers total data isolation. You can bypass external providers entirely by connecting your own self-hosted LLM solution, allowing you to maintain end-to-end control without data ever leaving your secure network. blog View all articles Security Updates and more DecisionRules Release 1.23: High-Performance Lookup Tables & Enterprise OAuth Security Dec 15, 2025 News DecisionRules: Empowered by ISO 27001 Standards Dec 2, 2024 News Mastering Rule Solves in DecisionRules SOLVE Function vs. HTTP POST Requests Jul 16, 2024 Learn About Enhancing Control and Collaboration: User Management in DecisionRules Apr 16, 2024 New Features Contact Security Team Reporting Security or Ethical Concerns If you wish to report a security vulnerability, ethical concern, or any issue anonymously, please contact our Compliance Team at privacy@decisionrules.io or use the form below. Name fields are optional - we respect your choice to remain anonymous.