Trust and security
The answers your security review asks for
Certification, isolation, access control and audit, on a page, so the questionnaire is a check rather than an exercise.
Independently certified
ISO/IEC 27001:2022Information Security Management
Certified by Citation ISO Certification. Controls over how building, tenant and client data is stored, accessed and protected.
ISO 9001:2015Quality Management
Certified by Citation ISO Certification. Audited processes for how we scope, deliver and review each deployment.
The marks shown are the certification body's. The ISO logo is not used, because ISO does not certify organisations and does not license its mark for that purpose.
How the platform keeps estates apart
Tenant isolation at the database
Every query runs inside a tenant scope enforced by row level security in the database, not by a filter in application code. A missing clause fails closed rather than leaking.
Eight roles, enforced server side
Super admin, admin, management, operations, engineer, client, viewer and supplier. Client and engineer views never carry the internal position, and that is enforced in the server rather than hidden in the interface.
Audited writes
Administrative writes run in a transaction that records the actor and the before and after state, and commits both together. The audit log is append only.
Scoped edge appliances
Each box holds a secret scoped to its own site, so one appliance cannot act as another. Transport security is verified on every call.
What we hold, and where
What the platform reads
Controller point readings, plant state, meter readings, asset records, job and compliance records, and the documents you upload. Vairitas is not designed to hold personal data beyond named users and the engineers recorded against work.
Sub-processors
Application hosting and database services run on certified infrastructure. A current sub-processor list is available on request, and the data processing agreement is published.
On your side
Named accounts only, with role-scoped visibility. A supplier without a login acts through a scoped portal or a single-use signed link rather than a shared account.
Running a security review?
Send us the questionnaire. We would rather answer it properly once than in fragments over six weeks.