Security

Our approach

We design our systems with defence in depth: minimize the data we collect, isolate workloads, encrypt data in transit, scope access, and monitor for unusual behaviour. Security work is an ongoing program rather than a one-time checklist, and we update this page as our practices evolve.

Infrastructure

Access Shift runs on reputable cloud providers whose data centres maintain industry-standard physical and environmental controls (typically aligned with SOC 2 Type II and ISO 27001). Production workloads are isolated from development and staging environments, and infrastructure changes are reviewed before deployment.

Data protection

All traffic to our APIs and dashboard is served over HTTPS with modern TLS. Customer data at rest is stored on encrypted volumes. Passwords are stored as salted, one-way hashes — we never store plaintext credentials. Routine encrypted backups of the production database are taken on a regular schedule and retained according to our retention policy.

Access control

Internal access to production systems is limited to the small subset of personnel who need it, granted on a least-privilege basis, and protected with multi-factor authentication. Access is reviewed periodically and revoked promptly when no longer needed. The dashboard enforces tenant-scoped queries so customers only see their own data.

Application security

Our application stack uses parameterized database access, schema validation on inbound API payloads, JWT-based session tokens with server-side issuance, and CSRF-resistant patterns for state-changing requests. Dependencies are tracked, and we apply security updates on a regular cadence.

Widget security

The remediation widget is served from our domain over HTTPS and is designed to run safely on customer pages: every fix is wrapped in defensive error handling so a single failure cannot crash the host page, and a circuit breaker bounds re-scan activity. The widget does not exfiltrate page contents, does not set tracking cookies, and exposes a revert function (window.__accessai_revert()) that restores the original DOM for debugging.

Monitoring and incident response

We collect application logs and error telemetry to detect unexpected behaviour. On confirmation of a security incident affecting customer data, we will notify affected customers without undue delay and provide the information required for them to meet their own regulatory obligations.

Vulnerability disclosure

We welcome responsible reports from the security community. If you believe you have found a security vulnerability, please email security@accessshift.com with a detailed description and reproduction steps. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

We ask researchers to act in good faith: avoid privacy violations, service degradation, and destruction of data. We will not pursue legal action against researchers who report findings under these terms.

Contact

For security questions or to request additional documentation (architecture, subprocessor list, penetration-testing summary), email security@accessshift.com.