Security

ConfianceCloud exists for one purpose: giving our clients and auditors a clear, trustworthy view of our compliance program. Because the portal itself handles sensitive material, it is built to a standard we would expect any of our own vendors to meet. Here is how we protect it, in plain terms.

Signing in

We never see or store your password. Sign-in is delegated entirely to a dedicated, industry-standard identity service (AWS Cognito), which handles your credentials, lockout protection, and password rules on our behalf. Multi-factor authentication is mandatory for every account — a password alone is never enough. There is no self-registration: accounts exist only when our administrator creates one for a named person, and access ends when it is no longer needed.

What you can see

Permissions are set per client. Your organization sees exactly the documents that have been shared with it and nothing else, and especially sensitive documents require an explicit, individual grant before they appear at all. Every document is checked against your permissions at the moment you open it, every time. Documents you view are watermarked with your organization's name and the date.

Accountability

Every sign-in, failed sign-in, page view, and download is recorded — who, what, and when. That log cannot be edited or deleted through the application, and it doubles as evidence in our own compliance program: we hold ourselves to the same record-keeping we ask of others.

The basics, always on

All connections are encrypted in transit and all stored files are encrypted at rest. The portal runs on dedicated, single-purpose infrastructure, kept separate from other systems and maintained under the same change-control and review discipline it exists to demonstrate.

Want the visual version? See how the system fits together — a four-part architecture overview.

Questions? We're happy to walk through any of this with your security team — contact us at the address below.