Security

SOC 2 report

None yet.

General availability

No. We are working with a small number of design partners.

Penetration test

Not done yet.

Written isolation design

Not published yet. It will say how apps are kept apart and who at intrium can reach a credential.

Data processing agreement

Not published yet.

HIPAA, FedRAMP and similar

Not supported. We do not sign a BAA.

Regions

Not chosen yet, so we cannot promise where data sits.

We would sooner you read this here than find it out in a security review.

Where apps run

Hosted by intrium on AWS to start, at a URL under your own domain. Running in your own AWS account is planned as the Enterprise option. AWS comes first, with Azure and Google Cloud later.

Who can open an app

Only members of the Okta or Google groups you choose for it.

Database credentials

Read-only, registered by IT, and supplied to the app when it runs. The person who built the app never sees them.

Uploaded files

Kept in a private bucket. Earlier versions are kept, and IT can see every upload.

Every deploy

Checked for secrets and dependency problems.

Outbound traffic

Apps can reach only the connections you approve.

Records

A catalog of every app with a named owner and a last-used date, and a log of who deployed what, and when.

Waitlist

Your email address and, if you answer them, the four optional questions.

Demo requests

Your name, email address, company and anything you write in the form.

IP addresses

Not stored. A salted hash is kept for a short time to limit repeated submissions.

This website runs on Vercel and stores what you submit in Supabase. We will only email you about intrium. To have your details removed, write to the address below.

If you find a security problem with this site, write to contact@intrium.dev. For questions a security review would ask, book a demo and bring them.