Data protection policy is documented
Security incident process is defined
Vendor and subprocessor review is covered by policy
Acceptable-use expectations are documented
Privacy responsibilities are assigned internally
Controls
Updated June 19, 2026System access standards are in place
Access requests require documented approval
Privileged access is scoped to job responsibility
Access is reviewed when roles change
Offboarding includes access removal
Customer data handling expectations are documented
Sensitive access is limited to business need
Data retention and deletion paths are defined
Backups protect critical operating records
Production data use is reviewed for support need
Production changes are tracked before release
Infrastructure changes are reviewed for risk
Emergency changes receive follow-up review
Release context is retained for review
Security-sensitive changes receive extra scrutiny
Code changes are reviewed before release
Protected branches gate production changes
Secrets are kept out of source control
Dependency changes are reviewed during delivery
Security-sensitive work keeps implementation context
Application errors route to monitoring
Cloud and edge events support investigation
Security-relevant activity is retained for review
Alerts route to responsible owners
Logs are used to support incident analysis
Security events are triaged by severity
Customer impact is assessed during review
Response owners and escalation paths are defined
Containment and remediation actions are tracked
Follow-up work is captured after resolution
Security findings are triaged by severity
Dependency and platform updates are reviewed
Vulnerability reports route to security triage
Remediation work is tracked to closure
Security monitoring supports investigation
Critical dependencies have named owners
Backup and restore expectations are documented
Operational contacts are maintained
Service-impacting events receive follow-up review
Continuity plans account for key providers
Subprocessors
View allCloudflare • Edge hosting and customer support
Resend • Email delivery
Amazon Web Services • Application hosting
Microsoft 365 • Business productivity and internal operations
Sentry • Logging and monitoring
Twilio • SMS and phone verification
Stripe • Payment processing
OpenAI • LLM API
Anthropic • LLM API
Grok • LLM API
FAQ
View allCan we review private security documents?
Yes. Send a request from your company email and include the deal, procurement, or security-review context. We will share the appropriate packet directly.
Where should a vulnerability report go?
Send it to security@irongorilla.ai with the affected surface, reproduction steps, impact, and any supporting evidence. Please avoid accessing customer data while validating a report.
How technical is the security review?
We can keep the review at a business level for procurement teams or go deeper for security engineers who need hosting, access control, monitoring, subprocessor, and incident-response details.