Security Practices

Tenant Isolation

• Logical isolation at data and application layers
• Scoped service accounts and least-privilege access

Encryption

• In transit: TLS for client and service traffic
• At rest: provider or customer-managed encryption keys (where supported)

Identity & Access

• SSO via CrocLock or your IdP (SAML/OIDC)
• Role-based access; administrative actions auditable

Vulnerability & Patch Management

• Routine dependency updates and security patches
• Issue triage based on severity and exploitability

Customer Responsibilities

Customers manage configuration, user provisioning, and data retention. Security outcomes depend on customer environment and controls.

This page summarizes practices and is not a certification or legal commitment. For audit materials, see the Audit Pack Guide.