Security & Compliance
Security is the foundation,
not a feature.
Demiton processes sensitive operational and financial data on behalf of civil contractors. We apply the same standard to our own infrastructure that we help our customers apply to theirs.
How the platform is built - zero-trust model, encryption, hardware isolation - is on Security Architecture.
Certifications & controls
ISO 27001
Aligned architecture - formal certification in progress
Australian Data Residency
Operational data in Azure Australia East. Model inference and Exa web search are the two exceptions, named.
AES-256 at rest · TLS 1.3 in transit
Envelope encryption with automated key rotation via Azure Key Vault
Append-only audit trail
Every read and write traced to a named Entra user. Immutable cold storage.
Hardware-isolated secrets
Integration credentials never stored in the application database. Azure Key Vault only.
Technical controls matrix
For your CISO, risk officer, or procurement team. Detailed whitepaper available on request.
| Authentication | Microsoft Entra ID (OIDC). MFA enforced. Passwordless and SSO options. |
| Authorisation | Role-Based Access Control (RBAC). Every action resolves against the requesting identity before execution. |
| Data in transit | TLS 1.3 enforced on all endpoints. Certificate pinning on adapter connections. |
| Data at rest | AES-256 encryption. Envelope encryption with per-tenant key hierarchy. |
| Credential vaulting | Integration secrets isolated in Azure Key Vault. Just-in-time access. Zero plaintext disk persistence. |
| Network isolation | Azure Virtual Network peering. Private Link for database and storage. Strict egress allow-listing. |
| Audit logging | Append-only logs of every transaction. IP address, outcome, and identity captured. Retained in cold storage. |
| Disaster recovery | Backups in Azure Australia East. |
| Vulnerability management | Static analysis (Bandit SAST). Secret scanning (trufflehog). Dynamic analysis (OWASP ZAP DAST). |
| Incident response | 24-hour notification SLA for material incidents. Dedicated security contact at support@demiton.io. |
Ghost Protocol
Credentials live in RAM only.
Traditional integration platforms write credentials to temporary disks during processing. If that server is compromised, those secrets are exposed.
Demiton keeps a credential in volatile memory only - pulled from the source system, used for the one call, and zeroed out once delivery is confirmed. Your registers persist, encrypted at rest. The secrets never do.
Result: Credentials never touch a hard drive in plaintext.
Responsible disclosure
We run a private bug bounty program for security researchers. If you have identified a potential vulnerability, contact support@demiton.io immediately. We acknowledge within 24 hours.
Procurement & compliance review
Running a supplier onboarding process? We can provide a detailed security questionnaire response, penetration test summary, or custom data processing agreement.
Request documentation →