Security & Trust

empirik is engineered from the ground up for modern enterprise engineering teams that operate under rigorous security and compliance mandates. Our core premise is zero-trust: our platform never requires access to production customer databases, raw customer payloads, or sensitive personal data.

Whether deployed within your own customer-managed cloud (self-hosted VPC) or utilized via our dedicated private SaaS tenant, empirik models the infrastructure topology, dependency graph, and CI/CD change vectors without ever touching production application runtime records.

We adhere to internationally recognized security standards and undergo independent external audits:

• SOC 2 Type II: empirik has attained SOC 2 Type 2 attestation across the Trust Services Criteria (Security, Availability, and Confidentiality) audited by leading independent CPA firms.
• GDPR & CCPA Readiness: We comply with global privacy standards, ensuring data minimization, right to erasure, and strict processing boundaries.
• Continuous Compliance Monitoring: Automated checks continuously validate infrastructure configuration against CIS benchmarks and SOC 2 security baselines.

Our artificial intelligence models and query generators (including Llama3 engines) operate within strictly isolated environments:

• Local / Isolated AI Execution: All graph crawling, schema analysis, and Cypher query generators execute within your designated environment.
• Zero External Data Leakage: No customer data, schemas, code, or topology metadata are ever shared with third-party AI platforms, public LLM providers, or model training sets.
• Tenant Isolation: In multi-tenant environments, every organization has cryptographically segregated data partitions and isolated database schemas.

All data processed by empirik is protected using industry-standard cryptographic protocols:

• Encryption in Transit: TLS 1.3 encryption is enforced for all API communications, dashboard access, and webhook transmissions with perfect forward secrecy.
• Encryption at Rest: All database volumes, object storage, and disk volumes are encrypted with AES-256 using dedicated KMS keys.
• Automated Key Rotation: Cryptographic keys are rotated automatically on a regular schedule according to NIST recommendations.

empirik supports enterprise-grade identity and authorization schemes:

• Single Sign-On (SAML 2.0 / OIDC): Seamlessly integrate with Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, and custom IdPs.
• Multi-Factor Authentication (MFA): Mandatory MFA enforcement across all administrative and user roles.
• Fine-Grained RBAC: Granular role-based access control allowing workspace separation, read-only audit roles, and team-scoped permissions.
• Ephemeral Credentials: API integrations use short-lived, rotatable tokens and IAM assume-role policies rather than permanent root keys.

Our cloud infrastructure is hosted in tier-IV data centers and shielded by multilayer network protections:

• DDoS Mitigation & WAF: Cloudflare edge protection and intelligent rate-limiting protect all inbound endpoints.
• Vulnerability Scanning: Automated container scanning, dependency vulnerability alerts (SCA), and static application security testing (SAST) in CI pipelines.
• Zero-Trust Network Segmentation: Micro-segmented virtual private clouds (VPCs) with zero public database exposure.

We maintain an aggressive business continuity framework:

• 24/7 Security Operations: Automated alerting and an on-call response team ready to triage anomalies around the clock.
• Customer Notification Protocol: Documented SLAs to notify affected customers within 24 hours of any verified security incident.
• Automated Backups & Disaster Recovery: Point-in-time recovery and multi-region replication ensure an RPO of under 1 hour and RTO of under 4 hours.

Every administrative action, policy adjustment, and user query is logged in immutable audit trails:

• Tamper-proof audit logs exported directly to your security information and event management (SIEM) tool (e.g. Datadog, Splunk, Sumo Logic).
• Real-time configuration drift detection across cloud resources, CI/CD pipelines, and IAM definitions.
• Full visibility into team member activities, graph queries, and export requests.