Security & trust
Security your IT team can check.
Our software runs inside election warehouses, R&D labs and production lines, so security reviews are part of almost every project. This page sums up what we do. The detailed documents are available under NDA.
- Independent assurance
- SOC 2 Type 1 report (2023)
- Hosting
- InThing-managed on Microsoft Azure, on-premises or hybrid
- Identity
- Single sign-on, roles and permissions, audit trails
- Workforce data
- Aggregate by default, with retention controls
Independent assurance
SOC 2 Type 1 report.
In 2023 an independent auditor examined InThing’s controls and issued a SOC 2 Type 1 report covering the Security, Availability and Confidentiality criteria.
A Type 1 report looks at how controls are designed at a specific point in time. It was preceded by a gap analysis and internal audits, and the policies and process documents written for it are now part of how we build, test and run Trapeze and Visium.
Your security or procurement team can read the full report under NDA. Ask us and we’ll send it along with any other documents your review needs.
Needs confirmation: Before launch, confirm whether a newer SOC 2 report (for example Type 2) has been issued and update the year and type.
- Report
- SOC 2 Type 1
- Issued
- 2023, by an independent auditor
- Criteria
- Security, Availability, Confidentiality
- Access
- On request, under NDA
Deployment options
Run it where your policies allow.
The same software runs in all four models, so the choice follows your IT and compliance rules. Server sizing for each one is in the Trapeze requirements.
Cloud
InThing-managed on Azure
We host and operate the platform on Microsoft Azure: updates, monitoring and capacity included. Public-sector customers can use a government cloud, as Philadelphia does for its election equipment.
On-premises
In your data center
Trapeze and Visium installed on your own servers, behind your firewall, for sites that keep operational data inside the plant or lab network.
Hybrid
Edge plus cloud
Device connections and event processing close to the readers, with applications and reporting in the cloud. Useful when sites have unreliable links.
High availability
Clustered
Distributed services across several servers for operations that cannot stop. A single server is enough for pilots and non-critical use cases.
Identity and access
The right people see the right data.
Access is managed through your own identity provider wherever possible, so joiners and leavers are handled where you already handle them.
- Single sign-on
- Microsoft Entra ID (Azure AD), LDAP and other OAuth2, OpenID Connect and SAML identity providers
- Multi-factor authentication
- Enforced by your identity provider when SSO is used; available for local accounts as well
- Roles and permissions
- Role-based access control with organization-level views, so a site, department or partner sees only its own items and events
- Audit trails
- Every event is timestamped and logged with the user or device that caused it
- AI features
- Visium AI works only through the secured Visium APIs, within each user’s permissions, and is switched on per customer
Data handling
What we store, and how we protect it.
Encryption in transit
Browsers, mobile apps, readers and integrations talk to the platform over TLS-encrypted connections.
Encryption at rest
In InThing-managed Azure deployments, databases and storage can be encrypted at rest with the cloud provider’s managed keys.
One instance per customer
Each customer gets its own Visium instance, and its data is kept separate from every other customer’s.
Backups and recovery
Backup and recovery are part of a written business continuity plan that we review and test on a regular schedule.
Data minimization
Asset and material tracking stores tag IDs, items, locations and events. Personal data is limited to user accounts unless you deploy InStep.
Open access to your data
Operational data can be exported through reports, read through the Visium API or published to your own systems by EAI-Bridge.
Secure development
Changes go through code review and testing before release, and access to production systems requires multi-factor authentication.
On-premises control
On your own servers, encryption, backups and retention follow your IT policies; we supply the requirements and support.
Needs confirmation: Wording kept deliberately general. Before launch, confirm the encryption-at-rest default and whether to mention the annual third-party penetration test.
Workforce privacy · InStep
Counting people without watching them.
Tracking employees, contractors and visitors needs more care than tracking pallets. Works councils, unions and regulators ask hard questions, and they should.
InStep reports occupancy and productivity by zone, floor and workstation. Individual location detail is there for the moments that need it, such as a muster during an evacuation, and only for the roles you allow.
- Aggregate by default: counts and metrics by zone, floor and workstation
- Role-based access: individual detail limited to the roles that need it, with role-based anonymization where appropriate
- Retention controls: location history kept only as long as your policy allows
- Opt-in workflows for programs that need consent
- Auditable: every location event timestamped and signed
For security reviews
How to request documentation.
We complete customer security questionnaires regularly, for public agencies as well as manufacturers and labs.
- Tell us what you needUse the consultation form, choose Something else and list the documents or questionnaire your review requires.
- Sign an NDAControlled documents such as the SOC 2 report are shared under a non-disclosure agreement.
- Receive the packSOC 2 Type 1 report, architecture and deployment overview, and server requirements for on-premises installs.
- Talk to an engineerWalk through open questions with the people who build and run the platform.
Security reviews
Starting a vendor assessment?
Send us your questionnaire or the list of documents you need. We’ll reply with what we can share and when.