Security

Security is foundational to everything we build. UltimateIntel processes sensitive business data from connected SaaS tools, which makes security not just a feature but a core requirement of our architecture. Every design decision, from database schema to deployment topology, considers security implications.

Infrastructure Our platform runs exclusively on Google Cloud Platform, one of the most secure and compliant cloud environments available. All 11 microservices are deployed on Cloud Run with auto-scaling and strict resource isolation. Only the API gateway is publicly accessible. All other services use internal-only ingress with OIDC-based service-to-service authentication. Our container images use Google's distroless base images to minimize the attack surface, containing only the application runtime with no shell, package manager, or unnecessary system utilities.

Key infrastructure security measures include SOC 2 Type II certified infrastructure, AES-256 encryption for all data at rest across Cloud SQL and BigQuery, TLS 1.3 enforced for all data in transit between services and to clients, VPC Service Controls for network-level isolation, automated vulnerability scanning of container images before deployment, and infrastructure as code for reproducible and auditable deployments.

Data Protection Tenant data isolation is enforced at the database level using PostgreSQL Row-Level Security policies. Every tenant-scoped table has RLS policies that prevent any cross-tenant data access, even in the event of application-level bugs. This defense-in-depth approach means that security does not depend on a single layer of protection.

PII is automatically filtered before every LLM call using regex-based pattern detection for email addresses, phone numbers, social security numbers, credit card numbers, and IP addresses. Our PII filter supports reversible redaction with secure rehydration, meaning we can remove sensitive data before AI processing and restore it in the response without the LLM ever seeing the original values.

Crypto-shredding provides permanent data deletion. Each tenant has a dedicated Data Encryption Key (DEK) wrapped by a master Key Encryption Key (KEK) stored in Google Secret Manager. When a tenant requests data deletion, destroying the DEK renders all encrypted data permanently unrecoverable. Deletion certificates are generated as cryptographic proof of destruction.

Access Control Authentication uses JWT tokens with plan-tiered rate limiting (100 to 5000 requests per minute depending on plan tier). The MCP server uses per-token scoping to limit AI agent access to specific data and operations. Comprehensive audit logging records every data access, query execution, and administrative action with timestamps and actor identification.

Incident Response We maintain a documented incident response plan with defined severity levels and response time commitments. Critical incidents receive a 15-minute response. Our on-call rotation ensures 24/7 coverage. Post-incident reviews are conducted for all severity-1 and severity-2 incidents with findings published internally.

Penetration Testing We conduct regular penetration testing through qualified third-party security firms. Test scope includes application-level vulnerabilities, infrastructure configuration, authentication and authorization bypass attempts, and data isolation verification. Findings are remediated based on severity with critical issues addressed within 24 hours.

Bug Bounty We welcome responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it through our support form with "Security concern" selected. Provide a detailed description of the vulnerability, steps to reproduce it, and any potential impact assessment. We acknowledge reports within 4 hours and work with reporters to verify and remediate findings.

Security Architecture Our microservice architecture follows the principle of least privilege. Each service has access only to the data and resources it needs to perform its function. Inter-service communication is authenticated and encrypted. Secrets are stored in Google Secret Manager and injected as environment variables at deployment time, never stored in source code or databases.