What we hold, where it lives, and what we don't have yet.
Most security pages are a wall of badges. We are a young company and we do not have all of them, so this page tells you exactly what is true today instead.
Our posture, honestly
In placeEncryption in transit and at restTLS 1.3 everywhere. AES-256 at rest, including database backups.
In placeTenant isolationEvery row is scoped to an account at the database layer, enforced in queries rather than application logic.
In placeCredential encryptionSMTP and third-party credentials are encrypted with per-tenant keys and never logged or displayed after entry.
In placeLeast-privilege accessA named subset of the team can reach production. Access is logged, reviewed monthly, revoked the day someone leaves.
In progressSOC 2 Type IIObservation window opens Q1 2027. We will not claim it, or imply it, before the report exists.
In progressThird-party penetration testFirst external test scheduled for Q4 2026. Summary published here when it is done.
Not yetISO 27001Not started. If it is a procurement blocker for you, tell us — it moves up the list when customers need it.
Not yetSSO & SCIMOn the 2027 roadmap. Available on Scale before general release if you need it.
Not yetHIPAA / FedRAMPOut of scope. Growixa is not suitable for protected health data.
Lead data comes from public business sources only — company websites, public professional profiles, job boards, company registries and press releases. Every record carries its provenance. Removal requests are honoured within 30 days, from the individual directly.
Found something?
Email security@growixa.com. We acknowledge within one business day and we will not threaten you.