Skip to main content

​
Tenant isolation

Every record belongs to exactly one organization, and every read and write is filtered by it. The organization comes from a verified session or token, never from anything a request supplies, so a caller cannot ask for another organization’s data by naming it. Sessions are bound to one organization at a time.

​
Credentials

Keyless where possible

Azure and GitHub involve no long lived secret from you. Access is a grant on your side, using short lived tokens issued at the time of use.

Always encrypted

Everything is encrypted at rest and in transit.

Yours to revoke

Every credential is one you created and control. Rotate or revoke it at your provider and Amnify’s access ends immediately.

​
What Amnify reads, and what it does not

  • Cloud access is read only and configuration only. Amnify reads how a resource is configured. It has no access to what is inside it.
  • GitHub access covers the repositories you select, and nothing else.
  • Repository write is bounded to a new branch and a pull request. Never your default branch, and never a merge.

​
Your documents

Documents you upload as knowledge sources are stored in a private store isolated to your organization. Only the extracted text is ever read by an agent, never the original file. Removing a document stops it being used immediately, and the passages quoted as citations stay protected the same way.

​
Nothing is taken on trust

No content is an instruction, wherever it comes from. That includes your own connected sources and your own knowledge base as well as pull request comments and pages encountered during a test. Anything that conflicts with security best practice is raised for a person to approve rather than acted on silently. See Security agents.

​
Hosting and compliance

Amnify is hosted in the EU, holds ISO 27001 certification, and is a Microsoft partner. A data processing agreement is available. The evidence Amnify collects across code, cloud and penetration testing maps onto control frameworks directly, starting with ISO 27001. Findings map to Annex A controls automatically, giving a continuous view of control status rather than a yearly snapshot, exportable as audit ready evidence. SOC 2, NIS2 and DORA follow the same evidence base.

​
Auditability

Every change to your data is captured immutably with its actor and cause. See Activity and audit trail.