Verified controls and clear boundaries.
This page describes controls visible in the current product and separates them from recovery, assessment, and certification work that is not complete.
The service verifies the active workspace before handling customer data.
Workspace queries and changes require an organization selected and verified by the service. Allocyn checks organization ownership before supported records are saved.
Access follows assigned organization permissions.
Organization administrators can assign role groups and supported permissions. Sensitive workspace, financial, reporting, administrative, and integration actions are checked on the server.
Use protected sessions and supported identity options.
The application uses secure, HTTP-only cookies in production. Local password access and Microsoft Entra sign-in are available according to organization configuration and package eligibility.
Stored connection secrets use application data protection.
Supported authentication and integration secrets are protected before persistence. HTTPS, HSTS, content-security, and related response safeguards are configured in the application. Production coverage still depends on correct reverse-proxy, certificate, key-storage, and hosting configuration.
Review records of supported security and workspace changes.
Allocyn records user sessions, workspace changes, and supported administrative actions. These records do not cover every event or replace a complete compliance audit.
Backup and recovery details are still being confirmed.
The backup provider, storage locations, recovery process, and completed restore tests are not yet confirmed for the live service. No tested-backup guarantee or recovery time is currently offered on this site.
Report suspected issues through the documented route.
Reports are triaged and handled according to risk. An independent penetration test and formal recurring external review are planned, not claimed as complete.
Use the security contact route for an urgent concern.
Include the affected address or account, observed behavior, time, and a safe reproduction description. Do not include live secrets or unrelated personal data.
AI uses information you are allowed to access.
AI features follow the current user's access and the service settings. AI provider processing details and contractual safeguards are still being confirmed.
No security certification or penetration test is currently claimed.
Allocyn is not currently represented as ISO/IEC 27001 certified, SOC 2 examined, GDPR certified, or independently penetration tested. Exact dates and scope will be published only after evidence exists.
Ask about the service your company would use.
Security also depends on how hosting, sign-in, storage, connections, backups, and support are set up and operated. Contact us to confirm the controls and supporting documents that apply to your proposed service and agreement.