Security · InsulatorOS

How we protect your tenant data, your crew's PII, and your customers' payment information. Last updated May 13, 2026.

Infrastructure

Hosting

Replit-managed deployments with automatic TLS (Let's Encrypt), DDoS protection, and edge caching. US data residency.

Database

Replit KV (encrypted at rest, automatic snapshots) for tenant operational data. PostgreSQL for legacy / Stripe sync only.

Backups

Replit's continuous platform snapshots (point-in-time recovery). Per-tenant export available 24/7 via Settings → Export.

Tenant isolation

Every key is namespaced co_<companyId>_… — cross-tenant reads are physically impossible without a code change.

Application security

Authentication. Bcrypt password hashing (10 rounds) and JWTs signed with a ≥32-char secret loaded at boot. The server refuses to start if the secret is missing or too short.

Rate limiting. Auth endpoints capped at 20 requests / 15 min per IP, demo requests 10 / hr.

Authorization. RBAC with five tenant roles (owner, manager, salesperson, crew_leader, accountant) and four platform roles. Every mutation goes through requireRole().

Audit log. Every state-changing admin action — permission grants, account changes, IVY auto-fixes, DSAR requests — is recorded in a tenant-scoped immutable log surfaced in Settings → Activity Log.

Browser hardening. Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy headers on every response.

Payments. Stripe handles all card data — we never see, log, or store a PAN. Webhook signature verified on every event.

Input validation. All HTML rendered from user data is HTML-escaped. Anthropic / OpenAI requests are content-fenced so contractor notes can't smuggle prompt instructions.

Operational

Vulnerability disclosure. Email security@insulateos.com. We respond within 48 hours and never threaten good-faith researchers.

Incident response. 72-hour notification window for any confirmed personal-data breach, per GDPR Art. 33 / CCPA timelines.

Sub-processors. Listed publicly at /sub-processors. We notify customers 30 days before adding a new one.

Insurance. E&O and cyber-liability policies in force; certificates available on request for enterprise contracts.

Customer rights

Export. Owners can download every record we hold — customers, jobs, invoices, employees, settings, audit log — as one JSON file from Settings → Export My Data.

Deletion. Owners can schedule account deletion with a 30-day grace period from Settings → Delete Account. Cancel anytime within that window.

Portability. The export format is documented and stable across schema versions.