Data security
idcom.ai is built AWS-native. Every customer's data lives in its own isolated tenant boundary, encrypted at rest and in transit, with full audit trails and an async ingestion pipeline designed for integrity from day one.
Every customer has its own boundary inside our AWS account — dedicated S3 prefixes, DynamoDB partition keys, IAM-scoped access, and Cognito user groups. Every API request is validated against the JWT’s tenant claim before any data path is touched. No tenant can read another tenant’s data, even by mistake.
TLS 1.2+ enforced at the edge for every connection in transit. AES-256 encryption at rest on every data store: S3 (SSE-S3), DynamoDB (AWS-managed keys), Cognito user pool data, and any future RDS instance.
AWS Cognito user pools with optional MFA, configurable per tenant. Short-lived (1-hour) JWT sessions, cryptographically validated on every API call. JWKS signing keys auto-refresh on rotation so the platform survives Cognito’s annual rotation without downtime.
CloudTrail captures every AWS API call. CloudWatch logs are retained for six months. Async ingestion uses per-tenant locks to prevent concurrent uploads from racing; idempotent workers handle retries safely; a scheduled sweeper recovers stuck jobs and a dead-letter queue captures permanent failures so nothing silently disappears.
S3 bucket-level versioning protects against accidental overwrites. DynamoDB Point-In-Time Recovery on every table (35-day window). Deletion protection on all stateful resources prevents accidental drops. Separate access-log bucket for forensic timelines.
GDPR principles applied platform-wide. Mexico LFPDPPP-aware. SOC 2 Type I on our roadmap; controls are designed to map to its trust services criteria. Data residency in AWS us-east-1 by default; LATAM or EU regions on request.
How tenant isolation works
Each customer's data lives behind its own S3 prefix and IAM policies. The only way for code to access tenant data is through a JWT-validated request whose claims match that tenant.
How data ingestion works
Files go from your browser straight to your tenant's isolated S3 prefix — never through a shared application server. From there an async worker validates, transforms, and merges the data with strong guarantees against partial writes or silent corruption.
The browser receives a short-lived (1-hour) presigned policy with a 200 MB hard cap enforced at the S3 edge — bytes never traverse our application servers.
A DynamoDB lock prevents two concurrent uploads of the same data source from racing. Conflicts return immediately rather than corrupting the merged dataset.
Async processing with conditional state transitions — duplicate invocations are no-ops. Schema validation, type coercion, and per-column data-quality warnings run before any data is committed.
A scheduled sweeper detects stuck jobs and a dead-letter queue captures permanent failures. Abandoned uploads expire automatically via S3 lifecycle rules — no orphaned data, ever.
Compliance posture
us-east-1 by default; LATAM or EU regions on request. Responsible disclosure
We take security reports seriously. If you believe you've found a vulnerability in idcom.ai, please email us before disclosing publicly. We respond within 48 hours.
security@idcom.aiFor all other security questions, write to hello@idcom.ai.