How we test security

The standard iyedy checks itself against, the tests that run on every change, and the certifications we do not have yet.

This page is for the people who decide whether iyedy is safe enough for their architecture: a security team, an architect choosing a tool, a buyer with a questionnaire. It says what we check, how often, and what we cannot show you yet.

The standard we check against

We assess iyedy against the OWASP Application Security Verification Standard (ASVS) 5.0, level 2, chapter by chapter: input handling, web front end, API, files, authentication, sessions, authorisation, cryptography, configuration, data protection, logging. Each chapter is marked met, partial or a gap, with the evidence behind it.

This is a self-assessment: we did it ourselves. It is a working tool, not a certificate.

What runs on every change

Automated tests run on every proposed change to the service, among them:

• Access across customers. Tests call every route of the service with another customer's workspace and diagram, and expect a refusal.
• Web protections. The security headers of every response: a strict Content Security Policy, HTTPS only, cookies that scripts cannot read.
• Rate limits. Repeated calls slow down and stop, for the sign-in as for the API.
• Restore. A backup is restored and checked, so that a restore works the day it is needed.

What protects you every day

• Every connection is encrypted, and the content of your diagrams is encrypted with a key of your own (Your data).
• Sign-in slows down after repeated failures, and passwords need at least 15 characters (Secure your account).
• The Assistant reads nothing above the AI ceiling, and you can turn it off (AI and your diagrams).

What we do not have yet

No SOC 2 report and no ISO 27001 certification today. Both are planned, without a date yet.

What this means for you

• A self-assessment is our own statement: weigh it as such in your review of iyedy.
• The list of the providers who process data for iyedy is sent on request: write to contact@iyedy.com.
• Found a flaw? Tell us first: Report a vulnerability.