How we protect an engagement's data.
This page is maintained by Alignd to answer the questions procurement asks first. It describes controls that are in place today. It is not a certification and not an independent audit.
- EncryptionTLS 1.2+ in transit; AES-256 at rest on the managed database and its backups.
- HostingManaged PostgreSQL in an EU region, run by our infrastructure provider with patching and monitoring included.
- Access modelRow-level security in the database: a row is only readable by members of that engagement. There is no cross-engagement view.
- Individual answersNever shown to either side. Only per-side aggregates are returned to the application.
- ImmutabilityOnce a week closes it is locked; historic scores and evidence cannot be rewritten.
- AuthenticationEmail and Google sign-in via a managed identity provider. No shared logins. No anonymous sign-ups.
- BackupsAutomated daily backups with point-in-time recovery, retained 7 days, encrypted and stored in the EU.
- Internal accessLimited to the people who operate the service, only when needed to fix a fault, and never to read individual pulse answers.
The demo versus the product
The demo on this website runs entirely in your browser: nothing you type in /onboarding or /dashboard is transmitted or stored by us. The real product is different — it stores your engagement's data in the EU-hosted, encrypted database described above.
Shared responsibility
We are responsible for the application, the database configuration, encryption, access controls, backups and keeping dependencies patched.
You are responsible for who you invite into an engagement, removing people when they leave the project, keeping accounts secure, and not putting special-category personal data into pulse comments.
Data handling
Retention, sub-processors and deletion timelines are set out in the privacy policy. Written data-processing terms are issued at pilot start; ask us for the current version and we will send it the same day.
Reporting a problem
If you believe you have found a vulnerability, or you need to reach us about a security incident, email hello@tryalignd.com with "SECURITY" in the subject. We acknowledge within one working day. If an incident affects your engagement data, we will tell you what happened, what data was involved and what we did about it — without waiting for a full investigation to close.