Security, data residency & trust

This page describes the security controls MaxInvent operates today. It is written to be checked rather than admired, so it also sets out what we do not have. If you are running a vendor review, the last two sections will save you a questionnaire round.

This page is the technical and organisational measures schedule referred to in our data processing agreement.

Tenant isolation

Each customer environment has its own separate PostgreSQL database. Customers do not share a schema, and there is no application-level tenant column that a query could fail to filter on.

We lead with this because it is the control that matters most in a multi-tenant system and the one most often softened in vendor descriptions. "Logical separation" usually means one shared database with a tenant identifier on every row, where a single missing clause in a single query exposes another customer's data. A separate database removes that class of mistake rather than defending against it.

Tenant context is derived from the request hostname, not from a header a client can set. Marketplace integration data is held in its own separate databases per marketplace service, and marketplace areas are blocked from tenant subdomains.

Hosting and data residency

• The application, its primary databases and file uploads all run in AWS London (eu-west-2), in the United Kingdom.
• Encrypted disaster-recovery database snapshots are copied to AWS Ireland (eu-west-1). Ireland is covered by UK adequacy regulations, so this needs no additional transfer safeguard.
• Some optional features and supporting providers process data outside the UK. Each is named, with its location, in our sub-processor list.
• The marketplaces, couriers and accounting services you connect follow their own regional arrangements. We do not control them.

We describe this as London primary with Ireland disaster recovery rather than as "UK-only hosting", because the second would not be true once you count the DR copy and the integrations.

Encryption

• In transit: TLS terminates at the AWS load balancer using an AWS Certificate Manager certificate. Database connections use TLS.
• At rest: AWS-managed encryption at the storage layer, covering database volumes, snapshots and object storage, with keys held in AWS KMS.
• Application level: AES-256-GCM is applied to integration credentials and access tokens — marketplace API tokens, courier mailbox credentials and courier invoice passwords.

Customer and buyer records — names, addresses, email addresses, phone numbers — are held in database columns protected by the storage-layer encryption above and by database-per-tenant isolation, not by a separate application-level cipher. We state that directly because "everything is encrypted with AES-256" is a common claim that usually means exactly this, and we would rather you knew which layer is doing the work.

Authentication and access control

• Passwords are hashed with bcrypt at 12 rounds. Hashing is one-way: we cannot recover a password, and neither can anyone who obtains the database.
• Time-based one-time password two-factor authentication, with backup codes, is available to every user. It can be enforced for administrators. It is not mandatory by default — see the section below.
• Role-based access control, enforced in the API layer.
• Sessions are invalidated when a password changes.
• Rate limiting and account lockout on authentication, with failed attempts recorded.
• Cross-site request forgery origin checks on state-changing requests.
• Cloudflare Turnstile on sign-in and registration.
• Production access is limited to named authorised maintainers.

Logging and audit

• An audit trail of administrative actions and record changes, recording who acted and when.
• Security events covering authentication and abuse signals.
• A separate control-plane audit of tenant lifecycle actions — provisioning, status changes and deletion.

These logs identify the person who acted, so they contain personal data. Our privacy policy explains that.

Backups and resilience

• 35-day point-in-time recovery on production databases.
• Nightly per-database dumps to object storage, copied to a second region.
• ECS rolling deployments with health checks and automated rollback.
• Marketplace synchronisation jobs are monitored for stale runs and operational drift.
• Export tools let you take a structured copy of your own data at any time. We think you should.

What we do not claim

Every item here is a real gap. We list them because a security page that claims everything tells you nothing, and because you would find these out during a review anyway.

• No ISO 27001, SOC 2, PCI DSS or Cyber Essentials certification. AWS holds certifications covering the infrastructure we run on. Those are AWS's, they cover the infrastructure layer, and they do not extend to our application. Any vendor implying otherwise is describing their hosting provider's audit as their own.
• No third-party penetration test. What we do instead: dependency vulnerability auditing in the build pipeline, an automated release guard over the highest-risk code paths, and a test suite that gates deployment. That is a weaker control than an independent test, and we are not going to pretend it is equivalent.
• Two-factor authentication is not mandatory. It is available to every user and can be enforced for administrators. We recommend enabling it on every administrative account.
• No application-level encryption of customer personal data, as set out under Encryption above.
• We never handle payment card numbers. Card payments run through Stripe's hosted checkout. This is not a gap, but it is the honest answer to a PCI question: the scope does not arise.

Your data is yours

We do not sell customer data. We do not use it to train machine learning models. We do not use it to build benchmarks or market analysis, in identifiable or aggregated form. These are contractual commitments in the customer terms and the data processing agreement, not just statements on a web page.

If you leave, you can export your data throughout your subscription and for 30 days afterwards, and we will not withhold it over a billing dispute.

Responsible disclosure

If you believe you have found a security issue, email hello@maxinvent.uk with a clear description, the affected URL, reproduction steps and your contact details. Please test only against your own account, and do not access, modify, delete or exfiltrate data that is not yours.

We aim to acknowledge within three business days. We will not pursue a researcher who acts in good faith under our acceptable use policy. We do not currently run a paid bounty.

Vendor reviews and procurement

This page is a summary, not a certification. Our data processing agreement, customer terms and sub-processor list are all published in full, so you can complete most of a review without talking to us.

For anything further, including a security questionnaire, email hello@maxinvent.uk.