Security
Your most sensitive financial evidence deserves a clear answer about where it goes.
Tuotix is a young company. That is a reason to be more specific about security, not less. Everything below is what is true today. Where something is not in place, it says so.
Security controls
Data residency
Customer documents and derived claim data are processed and stored in an EU-hosted environment. The infrastructure pins each region explicitly and refuses to deploy outside the approved set. Where a subprocessor is involved, the region it operates in is listed in the subprocessor register.
IN PLACE
Tenant isolation
Each customer environment is isolated. Documents, claims, dossiers and reading skills belong to one tenant and are not readable across tenants by design, not by configuration: every tenant-scoped table carries a forced row-level security policy in the database, and the application reaches it only through an authenticated tenant context that the data layer re-checks.
IN PLACE
Encryption
Customer data is encrypted in transit and at rest. TLS 1.2 is the enforced minimum on every public surface, and secret material is held in a managed key vault, separated from application-level access.
IN PLACE
Access controls
Role-based access for your team: the product defines distinct roles, and approval is restricted to the role that holds it. Access by Tuotix staff is named, granted for a stated purpose and revoked when it ends, under the terms agreed in the contract.
IN PLACE
Auditability
Access and processing events are written to an append-only audit log that refuses updates and deletes at the database level, so the record of who did what, and when, cannot be quietly revised.
IN PLACE
AI and model data handling
Models are used to interpret document structure. Reading skills learned in your environment are scoped to your tenant and are never applied to another customer. Customer documents are not used to train shared or third-party models.
IN PLACE
Retention and deletion
Retention periods are agreed in the contract, and each tenant's retention boundary is recorded against its data. Deletion on request is handled under those terms, including derived data, with backups ageing out within the stated backup window.
IN PLACE
Backups and recovery
Encrypted backups are taken automatically and retained for a defined window. Formal recovery point and recovery time objectives have not been agreed yet, so none are published here — we would rather state that than publish a figure we have not committed to.
IN PREPARATION
Subprocessors
The subprocessor register is being prepared for procurement, with purpose and operating region stated per subprocessor. It is not published yet. Ask us and we will tell you which processors are involved in your environment.
IN PREPARATION
Certification status
Tuotix does not currently hold SOC 2 Type II or ISO 27001 certification. We do not claim, imply or design around implying otherwise. Progress toward a formal programme will be stated on this page when it is real.
NOT CERTIFIED
DPA and NDA
A mutual NDA is signed before any document is shared, including for a Recovery Diagnostic. The data processing agreement is in legal review and is agreed before any customer data is processed.
IN PREPARATION
Certification status — stated plainly
Tuotix does not hold SOC 2 or ISO 27001 certification today.
The platform has been designed around tenant isolation, least-privilege access and auditable processing from the beginning. We will publish a certification status change on this page when there is one to publish — and not before.
A mutual NDA is signed before any document is shared. The data processing agreement is in legal review. Security questionnaires are answered by a named person, not a portal.
Discuss security requirements