We hold a map of our customers' compliance posture, so we hold ourselves to the same bar. Here's our real security posture — and how to get our documents under NDA.
No invented metrics. These are facts about how we run Elpista today.
We run our own SOC 2 program on Elpista with real, continuously collected evidence. Report in progress — not yet certified.
Disaster-recovery restore tested end-to-end in 7 minutes, with the audit chain verified intact.
A hash-chained audit trail: evidence and approvals can't be silently altered.
Customer data is hosted in Canada (Azure Canada Central). It doesn't leave the country.
Hosted in Azure Canada Central. Encrypted in transit (TLS) and at rest; secrets held in a managed key vault with soft-delete and purge protection.
SSO via Microsoft Entra, MFA enforced on production access, least-privilege roles, and periodic access reviews.
Each customer's data is logically isolated (row-level security); cross-tenant access is designed to be impossible and tested.
Security-relevant events recorded on a tamper-evident, hash-chained trail; cloud and identity logs collected read-only.
Point-in-time database backups with a tested restore procedure (RTO/RPO defined and exercised); Canadian-resident backups.
A short, reviewed list — Microsoft Azure (hosting), Anthropic (AI), Google Workspace, GitHub, and AWS (DNS only). Reviewed at least annually.
Elpista uses AI over compliance data — so we govern our own AI too, with controls mapped to NIST AI RMF and the OWASP LLM risks.
Our detailed documents are shared under NDA through an access-controlled, watermarked, logged document room — not published publicly. Request access and we'll grant a time-boxed view to what's relevant to your review.