1. Summary
Deployxa is a young platform, and this page states plainly where it stands today. We do not currently hold any third-party security or compliance certification or attestation. What we do have is a set of security controls built into the platform, a privacy programme designed around the GDPR, and payment handling delegated to established payment processors. This page will be updated when that changes.
2. Current posture
| Framework or area | Status today |
|---|---|
| Security certifications and audits | None currently held. Deployxa is not certified against any information security standard and has no independent audit or attestation report to share. |
| PCI DSS | Deployxa does not store, process or transmit full card numbers. Card payments are handled on the checkout pages of our payment processors (Stripe and Paystack), which maintain their own PCI DSS compliance. Payments made through Bachs are completed on Bachs’ own checkout. |
| Health data | Not supported. Deployxa does not sign Business Associate Agreements or equivalent health-data agreements, and you should not deploy protected health information. |
| GDPR / UK GDPR | We act as controller for account data and as processor for Customer Content. A Data Processing Agreement with Standard Contractual Clauses applies to all customers, and data subject rights are described on the GDPR rights page. This is our own assessment, not an external certification. |
| CCPA / CPRA | We do not sell personal data or share it for cross-context behavioural advertising. California residents can exercise their rights through [email protected]. |
| Cookie consent (ePrivacy) | Non-essential cookies and analytics scripts load only after opt-in through the cookie banner. See the Cookie Policy. |
3. Controls in place
Although uncertified, the platform implements controls that commonly map to these frameworks:
- per-app container isolation with resource limits and filtered system calls;
- TLS for all traffic, with automatically renewed Let’s Encrypt certificates;
- encrypted environment variables and secrets, excluded from build logs;
- role-based access control (Owner, Admin, Developer, Viewer), revocable API keys and organization audit logs;
- signed Git webhooks;
- scheduled database snapshots; and
- a published vulnerability disclosure process.
The Security Policy describes each control. Where our marketing pages say a control “supports” a framework, they mean the control can help your own compliance programme, not that Deployxa is certified.
4. Your responsibilities
Your compliance depends on how you build and run your apps as well as on the platform. You are responsible for the data you choose to deploy, the security of your code and dependencies, access within your team, your own privacy notices, and deciding whether Deployxa meets the requirements of your industry and regulators.
5. Security reviews and questionnaires
If your organization is evaluating Deployxa, email [email protected]. We are happy to answer security questionnaires and describe our controls in more detail. We will not represent that we hold a certification we do not have. Privacy and data processing questions go to [email protected].
6. Looking ahead
As the platform and its customers grow, we expect to pursue independent assessment of our controls. We will not announce a certification until it has actually been achieved, and we will update this page when it is.
Questions about this document? Email [email protected].