How SARPI Suite protects assessment data. These are AIgilityX's own commitments and descriptions of implemented controls — not third-party attestations or certifications.
Last updated 11 August 2026
Every application table that stores customer data has row-level security enabled. Reads and writes are scoped to the signed-in user, and organisation-wide access is limited to administrators and assessors of that organisation through security-definer role checks.
Pro and Enterprise capabilities are enforced server-side before any data is written or returned. Interface gates exist for clarity only; removing them in a browser does not grant access.
Share links carry a 256-bit random secret. Only a SHA-256 hash of that secret is stored, links carry an expiry date, and owners can revoke them at any time.
Redemption goes through a single server-side routine that rejects expired, revoked, unknown, and malformed tokens and returns nothing in those cases.
Assessment submissions are recorded in an append-only audit log, distinguishing a new submission from an idempotent replay of the same submission. Share redemptions are recorded with timestamp, outcome, and the signed-in viewer where one is present.
Audit records are readable by organisation administrators and cannot be edited or deleted through the application.
Traffic is encrypted in transit. Provider API credentials entered by administrators are encrypted with AES-256-GCM before storage, and only the last four characters are ever displayed.
Platform secrets are held in the managed environment and are never returned to browser code.
Each stored assessment is stamped with the methodology identifier and version used to score it, so a report can always be reproduced against the exact scoring logic that produced its numbers.
We do not claim any certification or regulatory compliance status on this page. If you require formal assurance documentation for a procurement process, contact us and we will confirm what is available in writing.
Please email hello@aigilityx.com with a description, affected URL, and reproduction steps. Do not test against other customers' data. We will acknowledge reports and keep you updated on remediation.
Reach the AIgilityX team at hello@aigilityx.com or through the contact form.
