Trust and security
How Steerline protects your organization's data, what is certified, and the documents your security review needs.
Live service statusDocumentsReport a vulnerability
Controls at a glance
Tenant isolation
Each organization’s data is separated in the database by PostgreSQL row-level security, enabled and forced on every table that holds client data. The application’s database role cannot bypass it, and the server refuses to start if it could.
Encryption and your own keys
TLS 1.2 or later in transit and encryption at rest. Stored secrets are sealed with AES-256-GCM. Enterprise organizations can bring their own Google Cloud KMS key: if they disable it, their organization is locked.
Sign-in
Single sign-on with OpenID Connect or SAML 2.0, SCIM provisioning, passkeys and security keys, authenticator apps and recovery codes. Administrators can require a second step and re-verification before sensitive changes.
Tamper-evident audit trail
Every change, sign-in, export and AI request is recorded. Entries form a hash chain that is signed every hour, and can be sent to your own SIEM (Splunk, any HTTPS collector, or syslog over TLS).
Data region
Your data stays in the region chosen at sign-up: Global. Each region runs its own database and file storage.
Support access only with consent
Our staff cannot see your data unless one of your administrators grants time-limited support access. Support sessions are read-only and written to your audit log with the operator and the reason.
AI safeguards
AI is off until an administrator turns it on. Personal data is replaced with placeholders before anything is sent, text that looks like instructions to the AI is removed, AI tools only read, and a person approves anything an AI proposes.
Certifications
Documents
| Document | Access | |
|---|---|---|
| Security questionnaire (SIG Lite / CAIQ style)Answers to the common security questionnaire topics, taken from our published security documentation. Items marked [to confirm] are not yet settled.security-questionnaire.md · 20 KB · updated 2026-11-14 | Public | Download |
Documents under NDA need a short request. We email a personal download link once an operator approves it.