Securitybuilt in, not bolted on
How it is built, and what we won't claim.
Most security pages are a wall of badges. This one says what the architecture actually does, and is explicit about the certifications we do not hold — because a buyer finds that out anyway, and finding it out late is worse.
Last reviewed 13 September 2026
Said first
What we are not certified for.
- SOC 2
current status: none / in progress with a date / report available. We will not imply a report exists before it does.
- ISO 27001
current status
- Penetration testing
last independent test, and whether a summary can be shared
- What you can have today
The architecture below, a security questionnaire answered honestly, and a conversation with the person who built it. For some buyers that is enough; for others it is not, and that is a fair answer too.
a badge you don't have
is not a badge
The architecture
Built in, not retrofitted.
- Tenant isolation
Every record carries its organisation, and access is scoped at the row level rather than by the application remembering to filter. A query that forgets its tenant returns nothing rather than somebody else's data.
- Capability-based authorisation
Permissions are named capabilities checked on every call, not a role that quietly accumulates. The policy can be simulated before publication and rolled back after it.
- Append-only audit
Who did what, when, and what changed — written to a log designed not to be edited, and verifiable.
- Agent identity
A connected agent is not a user with a bigger token. It holds a bounded capability set and an explicit list of people it may act as, and cannot exceed the authority of whoever created it. See how the connection works.
- Access governance
Access review campaigns, separation-of-duties checks and privilege-usage reports — granted against actually used — are product features rather than a spreadsheet someone maintains.
- Signed payroll
Payslips are cryptographically signed, with post-quantum signatures, so a payslip can be verified rather than trusted.
- Single sign-on and provisioning
SAML and OIDC for sign-in, SCIM for joiners and leavers, so removing someone removes them.
Operations
The parts a questionnaire asks about.
- Encryption
TLS in transit. At rest: cipher and key management
- Hosting
provider, regions, and their own certifications
- Backups and recovery
frequency, retention, and tested RPO/RTO
- Access to production
who, how it is approved, and how it is logged
- Incident response
notification target, e.g. within 72 hours, and the escalation path. GDPR requires notice to the supervisory authority within 72 hours of becoming aware of a qualifying breach; contractual terms to customers are in the addendum.
- Dependencies
how third-party code is monitored and patched
Reporting something
Found a problem?
Write to hello@debuginit.com with enough detail to reproduce it. We will acknowledge it, tell you what we found, and credit you if you want the credit. We will not threaten you for telling us — that should not need saying, and it does.
Also published at /.well-known/security.txt