Isolation by architecture
Every customer gets a dedicated Postgres database, provisioned at signup in the region you choose (EU or US). There is no shared ticket table and no tenant column — a cross-tenant query cannot be written, because the data isn't there to return. When you leave, your database is dropped as a unit: a clean, verifiable delete.
Encryption
- In transit: TLS 1.2+ everywhere, including between our services.
- At rest: AES-256 on databases, attachments and backups.
- Backups: encrypted, taken continuously, restorable per customer — your backup never travels with anyone else's data.
Access control
- Role-based access in your environment: agents, admins, requesters and approvers see only what their role allows.
- Multi-factor authentication for console admins.
- Staff access to customer environments is limited, logged and reviewed — support engineers access your environment only with your consent on an open ticket.
Auditability
Ticket history is append-only: actor, timestamp and reason on every change, with no edit or delete path. You can export the full trail to CSV or JSON at any time from your own database.
Compliance
- GDPR: we act as processor for your environment data — see the data processing agreement.
- SOC 2 Type II: in progress; the report will be available under NDA when issued.
- Sub-processors: listed in the DPA, with notice before any change.
Reporting a vulnerability
Found something? Email hello@alumanel.com. We acknowledge within one business day, keep you informed, and won't take legal action against good-faith research. Please don't test against environments you don't own — trials are free and take forty seconds.