Security / controls before claims

Federal growth intelligence built to be inspectable.

WinLayer combines tenant isolation, role-aware access, append-only audit history, evidence-grounded AI, and controlled delivery practices so teams can understand how the system handles decisions and data.

Read security documentation Request security review
CONTROL PLANEBETA CONTROLS
AUTH Clerk sessionsDATA Tenant scopedAUDIT Append onlyDEPLOY OIDC gated
Current assurance postureLocal controls tested; deployment review open
Independent certificationNot currently claimed
SOC 2Readiness groundwork only
Control architecture / implemented

Trust is a system of controls, not a row of badges.

These are product and delivery controls present in the WinLayer architecture. They are not presented as third-party certifications.

01

Identity + access

Clerk-backed sessions and role-based access for owners, admins, growth leaders, BD users, and viewers.

RBACSession controlsRole-aware UI
02

Tenant isolation

Workspace-scoped queries and forced database row-level security pass local isolation tests; staged and independent acceptance remain open.

Tenant scopingIsolation testsPrivate RDS
03

Auditability

Append-only audit history records sensitive changes, approvals, and governance actions.

Append-only historyGovernance exportsChecksums
04

Secrets + deployment

AWS Secrets Manager holds runtime secrets; deployment uses short-lived GitHub OIDC credentials.

No static AWS keysOIDCSecret rotation
05

Integration safety

HTTPS webhook delivery, HMAC verification, API-key controls, and SSRF protections guard external connections.

HMACHTTPSSSRF controls
06

AI governance

Generated recommendations retain evidence links, support human approval, and can be disabled with a system kill switch.

Grounded outputApproval gatesKill switch
Delivery assurance

Changes pass layered checks before deployment.

The delivery pipeline gates code quality, tests, application builds, infrastructure validation, accessibility, browser behavior, dependency risk, and container risk.

  1. 01CodeLint · types · tests · build
  2. 02ExperienceDesktop · mobile · WCAG checks
  3. 03Supply chainDependency · image scans
  4. 04InfrastructureTerraform validation
  5. 05ReleaseMigrations · source smoke tests
Assurance boundary / honest status

What WinLayer does—and does not—claim today.

Implemented now Role-based workspace access Tenant-scoped application queries Append-only audit records Controlled AWS deployment path Evidence-linked AI recommendations
Not claimed yetIndependent SOC 2 auditCompleted external penetration testCompleted production disaster-recovery drillGovernment authorization or FedRAMP status
Security details Data processing addendum Privacy policy