Security and data
Security and data handling
Where your data lives, who can reach it, and how the software protects it.
Where data is hosted
- Canadian clients · DigitalOcean Toronto (TOR1)
- US clients · DigitalOcean US East
DigitalOcean publishes its own certification reports. Its Toronto data centre is listed with ISO 27001 and SOC 2 Type II.
Ownership and access
- Your organization owns the code and the data.
- Code lives in your organization’s repository from day one; hosting and service accounts are in your organization’s name.
- On handover or termination, access is returned and documented.
How the software protects data
- Validation in code on every input and every AI output.
- Personal information scrubbed before text is sent to an AI model, where the project calls for it.
- Audit logs of who changed what, and when.
- Signature-verified webhooks for payments and integrations.
- Bot protection on public forms.
- Automated tests on critical paths.
AI providers
Each proposal names the AI provider, if any, and what data it processes. Nothing is sent to an AI service without that being agreed.
Certifications
Vigorous Software does not hold SOC 2 or ISO 27001 certification itself. The hosting layer is covered by the provider’s reports above; the company’s own controls are described on this page and in each proposal.
Talk to Igor
Replies within one business day.