Security isn't a feature. It's the default.
Every app we build is production-grade from the first line — tenant isolation, human sign-off, full traceability and code you own. Here's how we keep your data and your software safe.
Controls built into every app, not bolted on.
The safeguards procurement and security teams check for are part of how every Dual7 app is built.
Tenant isolation by default
Schema-per-tenant Postgres with row-level security and RBAC, built in from the start. One tenant can never read another's data — isolation isn't a setting you remember to turn on.
Human sign-off gates
Nothing reaches production without approval. Scope, migrations and security each carry a checkpoint a person signs.
Security audit on every change
Every change is audited for authz, validation and exposure before it can ship.
Audit logs on by default
Who changed what, when, and who approved it — recorded automatically, no setup.
Full traceability
Every line traces to a requirement and a sign-off. Auditors get a graph, not a guess.
Secret hygiene
Credentials are stored and injected correctly — never hard-coded into your app or logs.
Encryption in transit & at rest
Data is encrypted over TLS and at rest, with scoped access to production systems.
You own the code — so you can verify it
Export the full React, Node and Postgres repository and run your own security review. No proprietary runtime means nothing is hidden from your team.
Where we stand today.
We're specific about what's live, what's in progress, and what's available on request — no vague promises.
SOC 2 Type II
Controls and evidence collection underway with our auditor.
Tenant isolation
Schema-per-tenant + row-level security across every app.
Audit logging
Immutable change and approval logs, enabled by default.
SSO / SAML & SCIM
Enterprise identity and provisioning, scoped to your project.
Self-host / private cloud
Run your app inside your own VPC or data center.
Security review support
We support your vendor assessment and questionnaires.
Need our security documentation, a DPA, or to report a vulnerability? Email security@dual7.ai — or Book a Demo to walk through it with our team.
Tell us what your business needs. We'll show you how we'd build it.
Book a demo with our team. We'll walk you through relevant work and outline how a build would go.
No obligation · You own the code · Built around your workflow