Security Overview
This page summarizes how Temprix protects customer data. It is written for technical buyers and IT administrators evaluating the product — not as an internal audit report. We describe what we have built and how it works, without claiming certifications we do not hold.
Security at a glance
| Property | Status |
|---|---|
| Cloud provider | AWS (us-east-1, eu-central-1) |
| Encryption in transit | TLS 1.2+ via CloudFront and AppSync |
| Encryption at rest | AES-256 (DynamoDB default, S3) |
| Workspace data isolation | Enforced at API layer |
| Authentication | AWS Cognito |
| Google SSO | Supported |
| SAML / OIDC | Enterprise tier |
| Audit log | Immutable; all workspace mutations |
| Audit log retention | 6 months (Free), unlimited (paid) |
| Breach notification | Within 72 hours (GDPR Art. 33) |
| SOC 2 / ISO 27001 | Not certified |
Infrastructure
Temprix runs on Amazon Web Services across two regions: us-east-1 (N. Virginia) and eu-central-1 (Frankfurt). All customer-facing traffic is encrypted in transit using TLS 1.2 or higher, terminated at CloudFront and AppSync.
Workspace data is stored in DynamoDB with AWS default encryption at rest (AES-256). File assets are stored in S3 buckets with server-side encryption enabled. Static assets are served through CloudFront with signed URLs where applicable.
Data isolation
Temprix uses a multi-tenant architecture. Every API request is scoped to a
single workspace — enforced at the API layer through an X-Workspace-Id header
and pipeline validation in AppSync. Cross-workspace data access is not possible
by design.
When a workspace is created, the customer selects a Data Region. Workspace data is stored and processed in that region and is not migrated between regions after creation. See our Privacy Policy for details on what data may be processed outside the selected region (e.g., authentication identifiers).
Access controls
Temprix employees do not have routine access to customer workspace data. When access is required for support or incident investigation, it is granted on a case-by-case basis, time-bounded, and logged.
All AWS infrastructure access uses IAM roles with least-privilege policies. There are no shared credentials — access is role-based and scoped per environment (development, staging, production).
Within a workspace, access is governed by role-based permissions (Owner, Admin, Member). Admins control who can view and modify workspace data.
Authentication
User authentication is powered by AWS Cognito. Temprix supports Google SSO for sign-in. SAML and OIDC single sign-on are available on the Enterprise tier.
Sessions use short-lived tokens with automatic expiry. No persistent credentials are stored client-side.
Audit trail
Every mutation within a workspace — creates, updates, and deletes — is written to an immutable audit log. The log records who made the change, what changed, and when.
Audit log retention depends on plan:
- Free: 6 months
- Standard, Business, Enterprise: unlimited
Incident response
Temprix monitors infrastructure health through Amazon CloudWatch, including alarms for error rates, latency, and availability.
In the event of a personal data breach, Temprix will notify affected customers within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.
Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, contact us at security@temprix.app.
We do not operate a formal bug bounty program at this time, but we take all reports seriously. We will acknowledge receipt, investigate promptly, and coordinate disclosure with you.
Due diligence
For formal data processing terms and third-party service providers, see:
Contact
Security questions: security@temprix.app