Your Inspection Data Is Regulated. We Treat It That Way.
Tenant isolation enforced at the database engine. An append-only, hash-linked audit log that shows any change to a past record. No marketing claims without technical backing.
Security Architecture
Browser
CSP enforced, no unsafe-eval in production, HTTPS only
Application
Server-side rendered actions, RBAC middleware, rate limiting
Database
Row-Level Security on every table, tenant isolation at query level
Authentication
Industry-standard JWT authentication. Session management server-side. No credentials in application code.
Authorization
48 granular permissions across 7 roles. Checked at both application and database layers.
Tenant Isolation
Every database query is filtered by tenant ID through PostgreSQL Row-Level Security policies. User A cannot read, write, or detect Tenant B's data.
Audit Log Immutability
Once written, audit log entries cannot be modified or deleted. Enforced by database-level policies and triggers that reject UPDATE and DELETE.
Content security policy
Production deployments enforce strict CSP headers: no unsafe-eval, no unsafe-inline for scripts, frame-ancestors set to none.
Data Protection
Customer data is encrypted in transit (TLS) and at rest.
Incident Response
Acknowledgement: Within 24 hours
Security issues are acknowledged within one business day.
Critical vulnerabilities: Remediated within 30 days
Data exposure or tenant isolation bypass issues are treated as P0, in line with our disclosure policy.
Contact: security@reliatic.com
Report security concerns directly. No bug bounty program at this time.
Compliance Positioning
Reliatic is designed to support compliance with these standards. We do not claim certification or replace professional assessments.
| Standard | What Reliatic Supports | What It Does Not Do |
|---|---|---|
| API 580 / 581 | Risk ranking documentation, inspection scheduling evidence, approval workflows | Does not replace a certified RBI study or qualified analyst |
| ISO 55000 | Decision traceability, asset register governance, review cadence enforcement, lifecycle cost analysis with NPV | Is not a full EAM/ERP system (integrates with SAP PM, Maximo) |
| ISO 31000 | Risk identification, acceptance workflows, Monte Carlo simulation for risk quantification, sensitivity analysis | Does not replace domain-specific QRA or bowtie analysis |
| IEC 60812 | FMEA worksheets with S/O/D scoring, RPN calculation, action tracking, Weibull reliability modeling, failure rate prediction | Does not replace physics-of-failure modeling for novel failure modes |
| NORSOK Z-008 | Risk register, review trails, and escalation records aligned with Z-008 governance principles | Does not implement Z-008 consequence classification methodology or operational control system integration |
Data handling practices
How your inspection and asset data is stored, protected, and managed throughout its lifecycle.
Encryption
Customer data is encrypted in transit (TLS) and at rest.
Data Deletion
Full data purge within 30 days of contract cancellation. All tenant data, backups, and derived analytics are permanently removed. Deletion is confirmed in writing.
GDPR Rights
Full support for data subject rights: access, rectification, erasure, and portability. Requests are processed within the regulatory timeframe and logged in the audit trail.
Data Export
Your data is always exportable. Full tenant export in standard formats (CSV, JSON) available on demand. No vendor lock-in — if you leave, your data leaves with you.
What we explicitly do not claim
Most vendors only tell you what they do. Here is what we do not do — because transparency is a security property, not a marketing tactic.
We do not hold a SOC 2 report.
We do not replace qualified engineers. Reliatic is a governance tool, not an engineering calculation engine.
We do not guarantee regulatory compliance. We provide the evidence trail — your organization owns the compliance program.
We do not offer on-premise deployment. Reliatic is cloud-only.
We do not store or process payment card data. Billing is managed internally with no card data retained.
Engineering Responsibility
Reliatic is a governance tool, not an engineering judgment replacement. The platform calculates risk scores, recommends inspection intervals, and enforces approval workflows — but every recommendation passes through a qualified engineer before it becomes a decision.
When the system recommends extending an inspection interval from 12 months to 24 months based on quantitative risk analysis, a human engineer must review the recommendation, assess the site-specific context that the algorithm cannot capture (operational changes, process upsets, environmental factors), and approve or override the recommendation with a written justification.
This separation of calculation and judgment is deliberate. Algorithms excel at processing large datasets consistently. Engineers excel at contextual judgment. Reliatic ensures both capabilities are applied to every decision, and that the combination is permanently recorded.
Request security documentation
Procurement and vendor security teams can request our RBAC permission matrix and our subprocessor inventory.
- Information Security Policy (full version)
- RBAC permission matrix
- Subprocessor inventory
Sent to the contact you provide.
Ready to see how we protect your data?
Schedule a technical deep-dive where we walk through tenant isolation, audit log immutability, and access controls using your security requirements.
Request a security review