Security overview

1. Summary

AndonPulse is a Software Engineering Intelligence Platform. We help engineering leaders understand delivery performance, identify bottlenecks and see where engineering investment goes, so they can make better decisions about priorities and improvements.

AndonPulse has not completed a SOC 2 audit, is not ISO 27001 certified and has no independent penetration-testing or security-assessment reports available. Our self-assessment provides detailed answers; supporting evidence is available on request.

2. Hosting and customer separation

Core infrastructure runs on AWS in Northern Virginia, United States. Network boundaries restrict inbound access; AWS and Cloudflare provide network and edge protection. AWS operates the physical facilities.

Each organization has a separate analytics database. Shared application records and customer-facing access are scoped to the relevant organization; this does not mean each customer has dedicated infrastructure.

3. Encryption and access

Browser connections require TLS 1.3. External integration connections also use TLS; compatibility and supported versions are assessed separately for each integration. Customer databases and application-server storage use AES-256 encryption. Integration credentials have an additional layer of encryption, and passwords are not stored in readable form.

Production and customer-data access is limited to authorized personnel who need it. Administrative access requires individual accounts and multi-factor authentication. Access is reviewed quarterly and after material changes, and removed when no longer needed.

See our password and recovery safeguards. For customer multi-factor authentication, single sign-on or automated account provisioning, contact our Security team to discuss your requirements.

4. Secure development

Changes are reviewed using a documented checklist and tested before deployment. Application and infrastructure changes are recorded so they can be reviewed and traced; emergency exceptions require a reason and follow-up review. Information entering the service is validated to help prevent misuse.

Automated checks help identify security weaknesses, exposed secrets and vulnerable software components. Dependency findings are reviewed weekly. Findings are assessed by severity, assigned an owner and tracked through repair or a documented exception.

5. Monitoring and incident response

Service monitoring and alerts support investigation of availability and security concerns. Sensitive-value filtering limits unnecessary information in logs.

Our Security team triages and initially responds to security reports within 24 business hours. This is an initial-response commitment, not a resolution deadline or staffed 24/7 service. Affected customers receive updates; personal-data breach notification follows the DPA obligation without undue delay. Availability updates appear on our status page.

AndonPulse has not experienced any security incidents or data breaches.

6. Recovery

Automated encrypted database backups allow restoration within a seven-day recovery window. Restoration exercises check required information, configuration and access protections, and record recovery results. Version-controlled configuration supports rebuilding; we do not promise a guaranteed recovery time.

After paid service ends, imported records and derived analytics are retained solely for reactivation for 90 days, then deleted unless reactivated. Earlier authorized deletion requests and DPA obligations take precedence. Backup and final recovery copies have separate cleanup deadlines, within the existing 90-day maximum. Previously deleted information is removed again before restored data returns to normal processing. See retention, return and deletion.

7. Providers and privacy

We limit information shared with providers to what their services need. Subprocessors must have a SOC 2 audit report covering relevant services; we review them quarterly and after material changes.

Our Subprocessors register identifies providers and processing locations. The DPA sets out processing responsibilities. Data processing explains collection, customer choices, access, retention and privacy requests.

8. Security priorities

Continuing work focuses on recovery verification, access reviews and dependable security checks. We prioritize customer exposure, recoverability and customer requirements, and review practices quarterly and after material changes.