Security and Trust
A security vendor should be able to describe its own controls precisely. Not a badge wall: the actual mechanisms, named, and the boundaries stated rather than glossed.
Isolation enforced by the database
Tenant separation is PostgreSQL row-level security, not application WHERE clauses. It fails closed: an unset context returns zero rows rather than everything. The API and the worker connect as a role that cannot bypass it.
Narrow capabilities, never widened policies
When an operation needs access the isolation denies, it gets a single purpose-built function granting exactly that one ability to exactly that one caller. Deny-all stays the default everywhere else.
Named permissions, not blanket roles
Twenty-six named capabilities, six built-in roles, and your own roles if you want them. Authorisation fails closed, and nobody can put a permission into a role that they do not themselves hold.
Append-only audit trail
Audit entries are immutable, enforced by a database trigger that binds even the table owner. Records are written on a separate connection, so an entry survives a request that fails and rolls back.
Your identity provider, not ours
People sign in through your own IdP over OIDC with PKCE. Passwords and MFA never reach Neotelix. An account is created only after your provider has authenticated someone and every claim on the token has been checked.
Encryption verified, not asserted
Secure transport required at the database, TLS 1.2 minimum, insecure ingress disabled. Each confirmed against the live configuration rather than claimed from a design document.
Your data leaves when you do
Export runs on demand. Deletion deactivates immediately but opens a twenty-day recoverable window before anything is destroyed, and can be cancelled throughout.
Keys you cannot lose control of
API keys are stored only as SHA-256 hashes, shown once at issue, with no retrieval endpoint. Suspending an organisation stops its keys as well as its people.
Stated plainly. Encryption keys are service-managed; customer-managed keys are not offered today. There is no field-level encryption, and geo-redundant backup is not currently enabled. Neotelix holds no compliance certification. We would rather list these than let a checklist imply otherwise.
Questions from your security team?
Send them. We would rather answer a hard questionnaire early than discover a mismatch late.
Request a Demo