The same controls we build for clients, applied to ourselves.
StackWeaver is a compliance-engineering company. Security is not a department here — it is the product. Below is what we operate, what we align to, and who we rely on.
Request the security pack →Connecting a tool? See exactly what each connector reads, the access it asks for, and how to disconnect.
Controls we operate
Row-level security enforced in the data layer; access scoped per engagement.
TLS 1.2+ in transit; encrypted storage and integrity-checked artifacts.
Every access, change, and approval is recorded and attributable.
AI proposes; a named reviewer approves. No automated compliance opinion is issued.
Documented detection, containment, notification, and remediation process.
Security posture is evidenced continuously, not captured at audit time.
How access works
Four kinds of relationship can touch your evidence. Each is a separate account type with its own boundary — there is no shared login and no role that sees everything by default.
Your organisation’s own account. Sees and manages your evidence, requests and controls — nothing from any other company’s workspace, enforced in the database itself, not just the screen.
You choose who sees what: a scope (signed-off evidence only, or accepted and signed-off), an expiry date you set, and an organisation name for your own records. Revoke it yourself at any time — access ends immediately, not on their next sync.
If a partner firm brought your engagement to StackWeaver, they work from their own portal under their own confidentiality terms — a separate relationship from an auditor you invite directly, with its own access boundary.
Engineers and reviewers who work on your engagement, bound by confidentiality agreements, access logged and reviewed on a fixed cadence — the same least-privilege model as everyone else above, no standing exception.
Every review and sign-off is written to an append-only decision record, each entry's hash built from the one before it — so the history can be independently checked, and a change to a past decision would be detectable rather than silent.
Any piece of evidence can be checked against that record by anyone, at any time, with no account and no file upload — your browser fingerprints the file locally and only the fingerprint is sent. Verify a piece of evidence →
Frameworks we align to
Our platform and operations are built to these control sets. We are not yet independently certified; the controls are in place and evidenced continuously. Request current audit status from security@.
Sub-processors
We use a small set of third-party providers. A current list, including international-transfer mechanisms under NDPA and GDPR, is available on request.
- Supabase — Application database and file storage
- Clerk — Sign-in and accounts for the client and partner portals
- Cloudflare — CDN, DNS, firewall and hosting for this website
- n8n (self-hosted) — Workflow automation
- Resend — Transactional email
- Zoho Mail — Business email for enquiries and correspondence
- Sentry — Error monitoring
- Cloud AI providers — Website chat assistant; evidence analysis in the platform (subject to NDPA transfer controls)
- Paystack — Payment processing for the assessment deposit
- Calendly — Booking calls
- Google (Tag Manager, Analytics, YouTube) — Website analytics and embedded video
- Google Fonts and Fontshare — Web fonts served from the providers' servers
Responsible disclosure
Found a vulnerability? Report it responsibly to [email protected]. We acknowledge, investigate, and remediate, and we credit validated disclosures.
Report a finding →Common questions
What security standards does StackWeaver align to?
Our operations and the platform are built to SOC 2, ISO 27001, NDPA, and GDPR control sets. We are not yet independently certified; the controls are in place and evidenced continuously. Ask [email protected] for current audit status.
How is client data isolated?
Every customer is isolated at the tenant level with row-level security policies enforced in the data layer. One tenant cannot read another tenant’s evidence, controls, or artifacts.
Who can access my data?
Least-privilege, role-based access with full audit logging. Engagement team members are bound by confidentiality and non-disclosure agreements. Access is reviewed on a fixed cadence.
Can you sign an NDA before we share anything?
Yes, ask for one. Say so in the contact form or email [email protected] and attach your NDA template; we reply before you share any confidential information. You do not need to share confidential data to book an assessment call.
Do you use sub-processors?
Yes — authentication, database, email, and error monitoring are provided by third parties. A current sub-processor list, including international-transfer mechanisms, is available on request.
How are vulnerabilities reported?
We operate a responsible-disclosure process at [email protected]. Validate findings responsibly and we will respond and remediate.
Do you encrypt data?
Data is encrypted in transit (TLS 1.2+) and at rest. Evidence artifacts are integrity-checked and versioned.