Security is our priority.
The enterprise-grade security your IT team expects, built into the AI harness for your buildings.
Compliance
Inspectr is certified to ISO/IEC 27001:2022 (certificate ISMS-4819-20260808, issued 8 August 2026, valid through 7 August 2029). We completed a SOC 2 Type I audit in July 2026; the Type II observation period closed in September 2026 and the report is pending. Our policies are reviewed and updated annually.
SOC 2 Type I
ISO/IEC 27001:2022
SOC 2 Type II
Security & Privacy Practices
We maintain formal Information Security, Incident Response, and Business Continuity & Disaster Recovery policies. Our data handling practices are aligned with GDPR principles and designed to support customer compliance requirements.
Live controls, certifications, and audit documentation in our Trust Center.
Security Practices
Our comprehensive security program covers every aspect of how we build, operate, and protect the platform.
Your Data Stays Yours
You keep full ownership of your identifiable data and anything Inspectr generates from it. It is never used to train shared models, and what Inspectr learns about your organization is never shared with or applied to anyone else. You can ask us to correct, delete, or export it at any time.
Access Control
Role-based access means each person sees only what their role allows, and only within their own organization. Single sign-on and MFA are supported.
Infrastructure
All data is encrypted in transit with TLS and at rest with AES-256. Production systems run in dedicated private networks, with UK and EU hosting available, geo-redundant backups, continuous replication, and defined recovery objectives (RTO: 2-4 hours, RPO: <15 minutes for core platform services). Access is governed by least-privilege principles with mandatory MFA on all critical systems.
Threat Detection
Continuous threat detection runs across our production environment, and audit logs record administrative activity.
Secure Development
Our deployment pipeline includes automated SAST/DAST scanning, dependency vulnerability monitoring, and adherence to OWASP Top 10 secure coding standards. All production changes follow formal change management processes. Independent third-party penetration testing is performed periodically, with all findings remediated.
Data Privacy
Processing is limited to what's necessary under your agreement - no exceptions. We support data subject rights under GDPR and CCPA/CPRA, including access, rectification, erasure, and portability. International data transfers are governed by Standard Contractual Clauses where applicable. Data Processing Agreements are available on request.
Vendor Risk Management
All third-party providers undergo risk-based due diligence before engagement. Contracts include appropriate security, confidentiality, and data protection terms. Critical vendors are reviewed at least annually.
Incident Response
We maintain a documented Incident Response Plan with defined severity levels, prompt and prioritized response targets for critical incidents, and clear escalation paths. Breach notifications are issued in accordance with GDPR and applicable contractual requirements. The plan is tested annually through tabletop exercises.
Business Continuity
Our BCDR plan ensures service availability through automated backups, geo-separated storage, and tested restoration procedures. Stored files are versioned, so an accidental delete or overwrite can be reversed. Backup integrity is validated quarterly for critical systems. The plan is reviewed and updated annually.