Every customer's data is encrypted, audited, and ring-fenced. Below is the stack of controls, posture and proof-points your security team will ask for. No marketing fluff.
TLS 1.3 in transit, AES-256 at rest. Backups encrypted with rotated keys held in a separate region.
Every collection scoped by organisation id. Defense-in-depth at the API + database + audit layers.
Role-based access, MFA for admins, brute-force lockouts and full audit trail of every elevated action.
Sentry SDK on backend + frontend. Failed-login + integration drift triggers a trust event in real time.
What your security team will tick off in a typical procurement questionnaire. Colour-coded by current implementation status.
Third parties that may process customer data on our behalf, with their hosting region. We notify customers 30 days before adding any new sub-processor.
| Service | Purpose | Region |
|---|---|---|
| MongoDB Atlas | Primary database | EU (eu-west) |
| AWS S3 | Object storage (uploads, exports) | EU (eu-west) |
| Stripe | Payment processing | UK / EU |
| Resend | Transactional email | EU |
| Sentry | Error monitoring | EU |
| Anthropic / Google / OpenAI | LLM inference (opt-in) | EU / US |
Email security@gymaxisai.com — we usually respond within one UK working day. Existing customers can also raise a request from the Master Admin → Security tab.
We use essential cookies to keep you signed in and provide core functionality. We do not use tracking or advertising cookies. Privacy Policy