Versus connects to your most sensitive infrastructure — firewalls, load balancers, routers, and the credentials that operate them. That places security at the center of how the platform is built. These references are written for the security and compliance teams who evaluate Versus before adoption, at the depth an auditor expects.
Every actor gets the minimum access required. Tenant traffic never runs as a privileged database role; credentials are scoped by path and capability.
When context is missing or a check is inconclusive, access is denied — not granted. Isolation errors rather than leaks; unresolvable keys deny rather than expose.
No single control is load-bearing. Application scoping sits over database-enforced isolation; secrets are encrypted at the field and envelope level.
Controls are backed by tamper-evident audit, automated security scanning, and conformance tests — continuously demonstrated, not claimed once.
Two documents you can hand directly to a reviewing security or compliance team.
For security & compliance officers
The complete reference: data classification, encryption in transit and at rest, secrets management (Vault + PSM), identity and MFA, tenant isolation, database security, hash-chained audit, secure development, cryptography, deployment and residency, backup/DR — plus a compliance-officer Q&A. Framework mapping to SOC 2, ISO 27001, and GDPR, with honest control status.
Read the overviewFor security teams
A deep dive on how Versus enforces tenant isolation in the database itself with fail-closed, forced PostgreSQL Row-Level Security — the mechanism, the threat model, how it compares to Salesforce, AWS, Supabase, Azure, and Oracle, and an evaluator checklist.
Read the deep diveStated honestly — the technical controls exist; formal certifications are stated at their true status.
SOC 2 (Type 2)
Controls in place; formal examination in progress
ISO/IEC 27001
Architecture aligned to Annex A objectives
GDPR
Supported by design — residency, isolation, deletion
On-prem / air-gapped
Data never leaves your network
Detailed evidence — control mappings, scan reports, penetration-test summaries, the RLS conformance suite, and a Data Processing Agreement — is available under NDA. Our team will walk your security and compliance officers through any of it.
Request security evidence