Security at Conformata
This page describes controls that are implemented in the product today. It is not a certification. Conformata has not completed a SOC 2, ISO 27001 or similar audit, and does not claim HIPAA compliance.
- Tenant isolation
- Every customer record carries its organization identifier. The database enforces row-level security on every tenant table for the application's runtime roles, which cannot bypass it, and references between records are checked to stay within one organization. Access is re-verified against current membership on every request.
- Least privilege
- People are granted roles scoped to the whole organization, a site, or their own contractor company. Contractors see only their own company's people and evidence. Listing a record does not imply permission to approve, export or share it.
- Separation of duties
- Reviewers cannot approve evidence they submitted. Requirement changes need a different person to publish them. High-severity corrective actions must be verified by someone other than the person who fixed them.
- Immutable history
- Published templates, submitted inspection revisions, evidence versions, reviewer decisions, approvals, signatures and audit events cannot be edited by the application. Corrections are new records that reference what they replace.
- Private files
- Uploads go to a private quarantine area, are checked by content (not file extension), scanned for malware, and only then copied to immutable storage. Downloads are re-authorized on each request. Scanner outages never mark a file clean.
- No AI decisions
- Readiness is computed by deterministic, versioned rules from reviewed evidence. AI features are off by default and, when enabled, may only propose values for a named human to accept.
Last reviewed: September 23, 2026.