← Back to home Security

Security by architecture, not policy theatre.

The most important protections in our platform are not promises we make. They are properties of how the platform is built. This page explains what that means in plain terms.

Ariadnah Solutions B.V. ISO/IEC 27001:2022, DNV, May 2025

At a glance

The checklist your security team will ask for.

Before the architecture story, the answers a CISO or DPO scans for first. Each of these is verifiable: certificates through the public register, the rest as evidence under NDA.

ISO/IEC 27001:2022: Certified by DNV. Verifiable through DNV's public certificate checker.
Data in the EU: European cloud infrastructure (OVHcloud), under European jurisdiction.
Encrypted everywhere: AES-256 at rest, TLS in transit, including the database connection.
Non-public storage: Tenant-namespaced object storage. No public buckets, no direct object URLs.
Independent assurance: External penetration-test evidence will be shared when it is available. An independent engagement is planned; we do not claim a completed annual cycle today.
Tenant isolation in the database: Row-level security enforced by the database itself, failing closed.
Multi-factor authentication: TOTP-based MFA as standard.
AI on your terms: You choose the model provider and bring your own keys. Every AI-written change passes a four-eye approval gate.

How we think about security

Properties of the build, not promises about it.

Security is often pitched as a set of promises. We promise to encrypt. We promise to be careful. We promise we have passed an audit. Those promises matter, but they depend on people remembering to keep them. People forget, leave, or get overruled. Under pressure, promises bend.

We design the platform so that its most important protections do not depend on our engineers remembering to apply them. They are built into how the platform works. The practical consequence for you is that the security properties you would most want to trust are ones you, or a technical reviewer on your side, can verify independently.

What that means in practice

Eight structural choices, not eight promises.

There are eight things we have built into the platform and its operation that most modern software does not have. Each is a property of the build.

The eight

What each one changes for the reader.

Each item on the right is a structural choice, not a promise. They address the classes of failure that cause most modern software incidents: third-party data leakage, tenant bleed-through, hidden attack surface, supply-chain compromise, jurisdiction surprises, drift between audits, and the inability to reconstruct what happened.

A technical reviewer on your side can verify each property from evidence we will share under NDA: the deployment diagram, the surface inventory, the approved-dependency list, the release-gate configuration, and the audit-log schema.

Nothing calls out without your say-so: No analytics, no error-reporting service, no marketing pixel calling out while you use the platform. The AI assistants are bring-your-own-model: they talk only to the provider you configured, with your own keys, and every AI-written change passes a four-eye approval gate before it touches your records. Your regulated data goes where you decided it goes, and nowhere else.
Your data is separated at the deepest level: Most multi-customer software separates tenants inside the application code. Our separation happens inside the database itself. Even if our application makes a mistake, the database refuses to show one customer's data to another. The isolation does not depend on the carefulness of any individual engineer.
The ways into the platform are known and visible: Every way to interact with the platform is described in a single document. Our release process refuses to ship new code that adds a way in without adding it to that document first. There are no hidden entrances. A technical reviewer who asks for a map of the surface area already has one.
We do not add software libraries without review: The single most common class of security incident today is supply-chain compromise. We maintain an approved list of every third-party piece of software we include, and refuse to add anything new without a written review. Deliberate friction, the price of taking supply-chain risk seriously.
Security is checked every time we change code: Security is usually audited once a year and assumed to hold for the other 364 days. We check our security controls on every release. The release process reads an inventory of protections and refuses to ship if any are failing or out of date. We also run continuous adversarial tests against our own isolation.
The stack is European: The platform runs on European cloud infrastructure (OVHcloud), under European jurisdiction. Your compliance records for EU regulation live in the EU, with a provider that answers to EU law.
Held against the strictest application-security bar: The platform is reviewed against OWASP ASVS Level 3, the assurance level written for systems that hold high-value regulated data. The findings are not a report in a drawer: the hardening list is tracked as release gates, and a release does not ship past a failing gate.
Every important action leaves a permanent record: Granting a permission, adding a supplier, amending a contract, recording an incident. Every state-changing action writes a permanent record: who, when, what changed, whether it succeeded. The record cannot be quietly deleted. Review is a database query, not a forensic investigation.

Certifications

ISO/IEC 27001:2022, certified by DNV.

Ariadnah Solutions B.V. holds ISO/IEC 27001:2022, certified by DNV (issued May 2025). The scope covers the development, operation, and delivery of the Ariadnah compliance platform, and the advisory services around it.

You can verify the certificate directly through DNV's public certificate checker. Reference numbers, the statement of applicability, and the scope boundary are available to prospective and current customers under non-disclosure agreement.

An ISO/IEC 27001 certificate is not a one-time audit of a product. It is evidence that the structural controls on this page are embedded in a governance system, with defined ownership, regular review, and corrective action. Not the result of a single engineering burst.

What we do not claim

A trust page is more useful when it says what it is not.

Each of the items on the right is on a roadmap, covered by a compensating arrangement, or a deliberate non-goal. We would rather name them here than let a procurement questionnaire surface them first.

We are not FedRAMP-authorised, not SOC 2 Type II-audited, and not FIPS 140-3-validated. These are formal US-federal and third-party assessments. Parts of our posture would satisfy each of them. We have not completed the formal engagements.
We do not yet offer single sign-on with a corporate identity provider (SAML or OIDC). This is the most common reason a customer asks us to revisit a design choice. It is on our roadmap.
We do not yet offer passkeys. Authenticator-app codes (TOTP) are the second factor today.
We do not yet offer customer-managed encryption keys. Encryption keys are operated by Ariadnah.
We do not yet sell a packaged on-premises product. The platform can be hosted inside a customer's environment by arrangement, but we do not ship a supported on-prem product with packaged updates.
We do not publish an external penetration-test report today. Our internal adversarial-testing system runs continuously. An independent engagement is on the roadmap.

Reporting a security issue

How to reach our security team.

Security concerns, in the platform, on this website, or in our advisory delivery, can be reported to security@ariadnah.com.

We acknowledge reports within two business days, aim to issue a status update within ten, and credit reporters on request once a finding is resolved.

Next step

Bring a technical reviewer to a discovery call.

We are happy to walk a CISO, security architect, or procurement reviewer through each of the eight structural choices above, with the evidence behind them, under NDA. Related reading: About Ariadnah Solutions B.V., the Ariadnah platform, privacy policy, terms, cookies.

Book a discovery call →