Security

Inversa operates the Origin platform for government agencies and field partners. We maintain an information security management system aligned with ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria for Security, Availability and Confidentiality. An independent audit is in progress.

Infrastructure

• Hosted on Amazon Web Services in the us-east-1 region.

• Data is encrypted in transit (TLS 1.2 or higher) and at rest.

• Production databases are private and not reachable from the internet.

• Databases run across multiple availability zones, with automated backups and tested restores.

Access control

• Single sign-on and multi-factor authentication for staff.

• Least-privilege, role-based access.

• Access requests are approved and reviewed regularly.

• All administrative activity is logged.

Application security

• All code changes go through pull requests with required automated checks, including tests, static analysis and dependency audits.

• Continuous vulnerability scanning.

• Independent third-party penetration testing.

Monitoring and incident response

• Centralized logging and alerting.

• Threat detection.

• A documented incident response plan that is tested.

People

• Security awareness training and policy acceptance for all personnel.

Reporting a vulnerability

If you believe you have found a security vulnerability in Inversa's services, please email security@inversa.com.