Security Standards
Last updated Aug 1, 2026
The technical and organizational security measures ELIXIR CONSUMERS maintains.
Governance
An ISO 27001 certified information security management system, an annual SOC 2 Type II examination, and a security team reporting to the VP Engineering.
Data protection
AES-256 encryption at rest with per-tenant keys in AWS KMS; TLS 1.3 in transit; no customer content in logs.
Access control
SSO and hardware-key MFA for staff; just-in-time production access with approval and session recording; quarterly access reviews.
Application security
Secure development lifecycle, code review for every change, dependency and container scanning, and annual third-party penetration tests.
Resilience
Multi-availability-zone deployment, daily encrypted backups retained 35 days, quarterly restore tests and a documented incident response plan.
Vulnerability disclosure
Report vulnerabilities to security@elixirconsumers.com. We acknowledge reports within two business days. See /.well-known/security.txt.