Security Centre
Disclosurely is built for sensitive reporting workflows with transport encryption, server-side encryption at rest, tenant isolation, role-based access controls, audit logging, managed operations, and GDPR-conscious design.
This page is written for IT, procurement, legal, and security review. It describes the current production platform unless an item is explicitly marked Roadmap.
Executive summary
Disclosurely is a multi-tenant whistleblowing and case management platform. Customer data is organised by organisation, protected in transit with TLS, stored with server-side encryption controls, and accessed through organisation-scoped roles and audit-backed workflows.
The production environment is hosted on managed infrastructure in the EU. Security controls continue to evolve through internal review, production hardening work, and customer feedback gathered during real security and procurement reviews.
Security Overview
A concise overview of the current production security model.
Security-first product design
Disclosurely is designed for whistleblowing and case handling workflows where confidentiality, controlled access, and traceable actions matter from the first submission through case closure.
Encryption in transit and at rest
Transport is protected with TLS, and report content plus related evidence are stored using server-side encryption controls. Sensitive case content is not stored as plain text in the primary case tables.
Multi-tenant by default
Customer data is logically isolated per organisation. Access paths are organisation-scoped, supported by Row Level Security and role-aware permission checks.
Auditable operations
Case activity, user activity, workflow changes, and security-relevant events are recorded so customers can review the lifecycle of a report and the actions taken around it.
Managed platform operations
The production platform relies on managed delivery, data, and storage services so core controls can be reviewed and hardened without customer-operated infrastructure.
Privacy-first handling
Anonymous reporting does not require an account, file metadata is removed where applicable, and customers cannot identify anonymous reporters through the platform itself.
Trust Centre Resources
Procurement, security, legal, and compliance references grouped by the review path buyers usually follow.
Security
Identity, access, session, encryption, and monitoring references for IT security review.
Compliance
GDPR, EU Directive, retention, audit, and regulatory context for legal and compliance review.
Reporting
Anonymous reporting, secure messaging, report types, and reporter journey references.
Cases
Investigation workflow, evidence, and file-handling references for case management review.
Architecture
Disclosurely runs as a managed web application with optional AI processing outside the core reporting path rather than inside the submission flow.
Request flow
- 1. A reporter or case manager reaches the reporting portal through the managed web application.
- 2. The application uses managed identity, storage, and core data services for authentication and organisation-scoped operations.
- 3. Core case data is stored in EU-hosted PostgreSQL tables tied back to the relevant organisation and permission model.
- 4. Audit records, workflow events, and related security-relevant actions are recorded alongside the case lifecycle.
- 5. Optional AI processing is invoked only when a user requests supported AI functionality. It is not part of the default reporting path.
Application delivery
Runs the public-facing application through managed delivery infrastructure with HTTPS, request handling, and web-layer protections for the reporting portal.
Core platform services
Supports authentication, organisation-scoped data handling, encrypted storage, and the core data services used by the production platform.
Transactional email
Used for platform notifications and verification-related delivery only. It is not presented as a reporting-data workspace.
Billing systems
Handles billing and subscription events only. It is separate from the reporting and case-handling path.
Operational monitoring
Supports production issue investigation with masking controls so faults can be reviewed without treating operational telemetry as a reporting-data export channel.
Authentication
Disclosurely uses an email-based authentication model designed to reduce credential exposure while keeping access scoped to the relevant organisation.
- Single-use email verification codes are used for account access.
- One-time verification codes and one-time sign-in codes are issued during authentication flows.
- Authentication codes and related sign-in tokens are short-lived and limited to the requested verification or session-establishment step.
- Secure session management tracks active sessions and related activity after sign-in.
- Organisation-based permissions determine the data and actions available to each user.
- Role-based authorisation is enforced through organisation-aware role and permission records.
Disclosurely uses single-use email verification codes for authentication. Magic-link sign-in is intentionally avoided to maximise compatibility with enterprise email security gateways that inspect links before users interact with them.
Enterprise identity features such as SSO and enforced MFA are planned for future enterprise tiers. They are not represented here as currently available controls.
Encryption
Disclosurely uses transport and server-side encryption controls to protect report data and related evidence. The platform should not be described as end-to-end encrypted.
- TLS is used for communication between browsers, the frontend, and platform services.
- Report content is stored using server-side encryption controls rather than plain-text report bodies in the primary case table.
- Encrypted report handling is organisation-scoped, with access tied back to organisation permissions and case roles.
- Uploaded documents are handled through encrypted storage references and linked case metadata.
- For anonymous submissions, metadata stripping is applied where applicable to reduce identifying information in uploaded files.
- Authorised users within an organisation can decrypt and view reports according to their permissions and assigned access.
Encryption in Disclosurely protects data in motion and at rest, but it does not prevent authorised users inside the relevant organisation from decrypting and working on reports when their role allows it.
Tenant Isolation
Customer organisations are logically isolated within a shared production platform.
- Organisations are logically isolated inside a multi-tenant architecture.
- Row Level Security is enabled on core customer data tables, including organisations, reports, profiles, and related operational records.
- Organisation-scoped queries are used throughout the production data model to keep access bound to the relevant tenant.
- Role-based access enforcement sits alongside tenant boundaries so users only see the cases and records their role permits.
- Recent tenant-isolation hardening work has strengthened production organisation boundaries without exposing sensitive implementation detail.
- Isolation controls continue to be reviewed as part of ongoing security improvement work.
Anonymous Reporting
Disclosurely includes an anonymous reporting route designed to let whistleblowers submit and follow up on reports without creating an account.
- A dedicated anonymous reporting portal supports account-free submission.
- Optional file uploads are supported for evidence and supporting material.
- Metadata stripping is applied where applicable to reduce identifying file metadata on anonymous submissions.
- Anonymous two-way messaging allows follow-up questions and clarifications without requiring identity disclosure.
- Reporters use a tracking ID together with a private access secret to return to their report.
- Organisations cannot identify anonymous reporters through the platform itself.
Audit & Compliance
Case handling and operational accountability are supported by structured audit history and lifecycle tracking.
- Case lifecycle events are recorded from submission through review, investigation, and closure states.
- Audit history captures user activity, workflow activity, and related operational metadata.
- Audit records are designed to support change detection and integrity review, including chained record fields in the core audit table.
- Exportable audit history supports legal, governance, and customer review requirements.
- Workflow logs, security events, and related audit records help preserve operational traceability around sensitive cases.
- Internal Disclosurely support activity is kept separate from customer audit records through dedicated internal audit logging.
Customer audit history is distinct from internal founder or support activity. That separation helps preserve a cleaner customer-facing record during investigations and reviews.
Infrastructure
Production infrastructure relies on managed services for delivery, compute, database operations, storage, and supporting controls.
Managed application delivery
The web application is delivered through managed hosting with HTTPS, request handling, and network-layer protections for the public-facing service.
Core data services
Managed database, authentication, encrypted storage, and organisation-scoped access controls support the production data model.
Web-layer protections
HTTPS is used across the platform, and the web layer applies controls such as CSP, frame restrictions, referrer policy, and MIME-type protections.
Webhook verification
Internal webhook handling verifies provider signatures before events are processed.
Rate limiting and lockouts
Sensitive authentication flows apply throttling and lockout controls to reduce abuse and repeated verification attempts.
Ongoing hardening
Production security improvements are made continuously as the platform evolves and controls are reviewed.
Data Residency
Current production customer data is hosted within the EU.
- Production customer data is currently hosted within the EU.
- Current hosting is configured within an EU-based production environment.
- Regional hosting options are planned for enterprise customers.
- This page does not promise regional-hosting delivery dates that are not already available in production.
Regional hosting flexibility is part of the longer-term Trust Centre roadmap, but current production hosting should be evaluated as EU-based.
Backups & Recovery
Backups and recovery rely on managed infrastructure capabilities rather than customer-operated platform components.
- Managed database backups are used for the production data layer.
- High availability is supported through managed frontend, database, and storage services.
- Disaster recovery planning follows the managed-service model used by the platform.
- Recovery objectives are not stated here unless they are contractually agreed and operationally documented.
AI & Data Processing
AI support is available for selected case workflows, but it is optional and outside the default submission path.
- AI features are optional.
- AI is used only when requested by an authorised user.
- Reports are not automatically processed by AI as part of the core reporting flow.
- Supported AI functionality currently covers summarisation, categorisation, and analysis assistance.
- Customer data remains encrypted at rest in the core platform data layer.
- AI processing relies on approved third-party providers when enabled.
- Current service categories are listed in the Supporting Services section.
- Customer data is not used to train public AI models.
- AI processing is limited to the requested functionality and routed through logged, organisation-scoped request handling.
AI output is designed to assist case handling, not replace human judgement, legal review, or governance decisions.
GDPR & Privacy
Disclosurely is operated with UK GDPR and EU GDPR considerations in mind, with controls aimed at minimisation, accountable processing, and customer control over report data.
- Privacy by design informs product decisions for sensitive reporting workflows.
- Customer report data is handled with export and deletion request workflows in the production data model.
- Organisation-level retention controls are available through retention policy records.
- Privacy handling is described alongside controller and processor roles in the Privacy Policy.
- UK GDPR and EU GDPR considerations are reflected in hosting, retention, deletion, export, and access-control design.
For controller and processor roles, retention details, international transfer handling, and contact information, review the Privacy Policy.
Supporting Services
Current service categories used by the production platform and public site.
| Service Area | Purpose |
|---|---|
| Core platform services | Authentication, organisation-scoped data handling, object storage, and core server-side platform operations. |
| Application delivery | Public web application hosting, delivery, and runtime support. |
| Transactional email | Verification-related and operational email delivery. |
| Billing systems | Subscription and billing processing. |
| Optional AI services | Supported AI-assisted summaries, categorisation, and analysis flows when enabled. |
| Operational monitoring | Error monitoring and production issue investigation. |
| Site analytics | Website usage analytics for the public site. |
Security Documents
Reference materials available now, plus planned trust resources that are not yet published.
Privacy Policy
Current privacy terms, controller and processor roles, data handling, and contact details.
Data Processing Agreement
DPA resource for procurement and legal review.
Supporting Services
Current service categories used by the platform and public site.
Responsible Disclosure Policy
Private vulnerability reporting process and security contact details.
Security Questionnaire
Structured due diligence pack for buyer review.
Penetration Test Summary
Summary document placeholder for future trust materials.
SOC 2
Certification placeholder only. No certification is claimed here today.
ISO 27001
Certification placeholder only. No certification is claimed here today.
Responsible Disclosure & Security Contact
Disclosurely encourages responsible, private reporting of security issues and provides a single contact point for enterprise review activity.
Responsible disclosure
Security researchers can report vulnerabilities privately to security@disclosurely.com. Reports are reviewed promptly and handled through a coordinated disclosure process.
Security contact
Enterprise security questionnaires, procurement enquiries, vendor due diligence requests, and security reviews should be sent to security@disclosurely.com.
Security Updates
Recent hardening work recorded for this Trust Centre. Dates below reflect the documentation record for recent production-focused improvements.
- Recorded2026-07-13Note 01
Tenant isolation hardening
Production organisation boundaries were tightened to reinforce organisation-scoped access paths and strengthen isolation controls across sensitive workflows.
Impact: Reduces the risk of cross-organisation access and improves confidence in tenant boundary enforcement. - Recorded2026-07-13Note 02
Anonymous messaging hardening
Anonymous follow-up flows were reviewed and tightened so reporters can continue two-way communication without creating an account or exposing their identity.
Impact: Improves protection around anonymous follow-up without changing the core reporting workflow. - Recorded2026-07-13Note 03
Attachment integrity validation
Evidence handling was improved around encrypted attachment storage, access tracing, and related upload controls.
Impact: Strengthens confidence that uploaded evidence remains intact and tied to the correct report context. - Recorded2026-07-13Note 04
Webhook signature verification
Internal webhook processing was updated to verify provider signatures before events are accepted and processed.
Impact: Reduces the chance of unauthorised or spoofed webhook traffic being processed by the platform. - Recorded2026-07-13Note 05
Founder Console isolation
Internal support and founder activity was separated more clearly from customer tenant records and audit history.
Impact: Improves separation between internal operational activity and customer-visible audit records. - Recorded2026-07-13Note 06
Role-based authorisation improvements
Role definitions and permission handling were refined to keep access closer to job function and organisation scope.
Impact: Narrows access to the actions and records needed for each role, supporting least-privilege handling. - Recorded2026-07-13Note 07
Authentication flow improvements
Email-based sign-in flows, verification handling, and session-related controls were reviewed and improved in production.
Impact: Improves reliability and control around verification, sign-in, and active session handling. - Recorded2026-07-13Note 08
Security review programme
Security changes are reviewed continuously, with production improvements informed by internal reviews and customer feedback.
Impact: Creates a repeatable path for hardening work instead of treating security changes as one-off tasks.
Trust Centre (Coming Soon)
Planned trust resources are listed here so buyers can see the intended structure without treating them as currently available documents or certifications.
FAQs
Short answers to common security review questions.