← Back to almxpp.com

Security & Compliance

Last updated: 16 August 2026 · Written for security reviewers and procurement teams

1. Architecture

• Single-tenant application hosted on Azure Container Apps, West Europe, fronted by a managed TLS endpoint.
• Persistent state on Azure Storage (file share and blob) in the same region.
• The knowledge base is derived from the standard Microsoft D365 F&O platform source. Customer content enters only through explicit, opt-in upload.
• Customer-uploaded models are indexed in separate namespaces and are not returned to other accounts.

2. Data protection

Control	Status
TLS 1.2 minimum, enforced at the storage account and the ingress	Implemented
HSTS, Content Security Policy with per-request nonce, COOP, CORP, frame-ancestors none	Implemented
Encryption at rest (platform)	Implemented
Account store additionally encrypted with AES-GCM	Implemented
Passwords stored as salted hashes; API tokens stored as hashes only	Implemented
Customer-managed encryption keys	Not available

3. Access control

• Role-based access control with deny by default: an unauthenticated or unknown token is refused, never granted read access.
• Access to another organisation's indexed repository requires an explicit grant. Ownership is recorded at creation; it is not inferred from whoever calls first.
• Client administrators can administer their own organisation only. They cannot read other tenants' data and cannot make a repository public.
• Stale grants — deleted accounts, rotated tokens — can be pruned, supporting periodic access review.
• Administrative and security-relevant actions are written to an append-only audit log, retained 90 days.

4. Resilience

• Backups of persistent state, with a written restore runbook.
• The restore procedure has been executed, not merely documented. Last exercise: full recovery in 548 seconds, with integrity of the account and client-profile stores verified against their expected sizes.
• Known limitation: the service runs at a maximum of one instance. There is no high-availability pair, and deployments therefore cause a short interruption. Storage is locally redundant, not zone- or geo-redundant. We do not offer a contractual SLA by default.
• Outside published operating hours the service enters a reduced-power standby; the first request afterwards may take a few minutes.

5. Secure development

• Automated test suite (1 100+ tests) executed on every change.
• Dependency vulnerability scanning in the build pipeline; a known vulnerable transitive package fails the build.
• Software Bill of Materials (CycloneDX) produced at build time and available on request.
• Secrets are supplied as platform secrets and environment variables, not committed in source.
• Not in place: independent penetration testing. Automated baseline scanning is performed; no third-party pentest report exists.

6. Vulnerability disclosure

We welcome reports from security researchers. Machine-readable contact details are published at /.well-known/security.txt.

• Report privately to alim.ben.helal@gmail.com. Please allow 90 days before public disclosure.
• We acknowledge within 5 business days and give a remediation estimate within 15.
• Testing must not degrade the service or access other users' data. Do not run volumetric denial of service, do not attempt social engineering, and do not pivot beyond proving impact.
• Research conducted within these rules will not be pursued legally. We do not currently pay bounties.

7. Certifications — stated plainly

Framework	Position
ISO/IEC 27001	Not certified. Controls are aligned with the standard; no accredited audit has taken place.
SOC 2	No report. No Type I or Type II attestation exists.
GDPR	Erasure and portability implemented as self-service; processor terms published at /dpa.
Underlying infrastructure	Microsoft Azure holds ISO 27001, SOC 2 and other certifications. These cover the platform, not this application.

If your procurement process requires a certified processor, we are not currently one, and we would rather you learn that here than at the end of an evaluation.

8. Requesting documentation

The following are available on request to prospective and existing customers: the sub-processor list, the SBOM, the backup and restore runbook, the incident response procedure, and a completed security questionnaire. Write to alim@almxpp.com.