Security

AlignHQ holds evidence about your security program. This page describes how that data is accessed and stored.

Read-only integrations

Integrations use read-only access where the provider offers it. AWS connects through a read-only IAM role that you create in your own account, scoped by an external ID that AlignHQ generates when you set up the connection.

Encryption

Data is encrypted in transit with TLS. Application data is stored in Postgres hosted on Neon and evidence files in Cloudflare R2, and both providers encrypt that data at rest. AlignHQ encrypts integration credentials itself, with a separate key for each workspace.

Tenant isolation

Access to controls, evidence and settings is scoped to the workspaces you are a member of.

Reporting a vulnerability

If you believe you have found a security issue in AlignHQ, email security@alignhq.io. Include the steps to reproduce it and any affected URLs.