Security & Privacy
Trust Center
Your Data. Your Trust. Our Responsibility.
Your data is one of your most valuable assets. At ELYX, protecting it is fundamental to everything we do. We combine enterprise-grade security and privacy-by-design principles to keep your information confidential, protected, and under your control. As we process sensitive identity and business data to deliver identity intelligence, we apply robust governance and technical safeguards at every stage.
Security & Operational Excellence
- Security and privacy built into the platform from day one
- Structured governance for data protection and risk management
- Continuous security reviews and operational monitoring
- Aligning with industry-recognized frameworks as we scale
Privacy by Design
- GDPR-aligned privacy framework
- India's Digital Personal Data Protection (DPDP) Act 2023 embedded into operations
- Data minimization and privacy-enhancing techniques throughout
Secure Infrastructure
- Logically isolated, multi-tenant customer environments
- Encryption in transit and at rest, with network segmentation
- Enterprise-grade Microsoft Azure hosting
- Geo-residency and high-availability deployment options
Access Control & Accountability
- Least-privilege, role-based access controls (RBAC)
- Segregation of duties and approval workflows
- Comprehensive audit trails and continuous monitoring
Platform Safeguards, Specifically
The concrete controls behind the principles above.
- Read-only connectors
- ELYX reads identity and access metadata from your systems. It never creates, changes, disables or deletes anything in them.
- Encrypted connector credentials
- Connector secrets are encrypted with AES-256-GCM using a separate key derived for each integration, and are masked whenever they are displayed.
- Dedicated key vault option
- Connector secrets can be held in a dedicated Azure Key Vault per customer, with role-based access and soft-delete protection.
- Enterprise sign-in
- Users sign in through Microsoft Entra ID. Your own identity provider, such as Okta, can federate through Microsoft Entra External ID.
- Defined retention
- Sign-in events are kept for 30 days, resolved risk signals for 90 days and control-run history for 365 days.
- Hosted on Microsoft Azure
- The platform runs on Microsoft Azure in US regions, with managed PostgreSQL and encryption at rest.
Governance & Compliance
Trust starts with strong governance.
ELYX operates with a security-first, privacy-by-design approach, applying industry-recognized best practices across information security, data protection, and operational governance. Our controls and processes are designed to safeguard customer data throughout its lifecycle while supporting reliability, accountability, and continuous improvement.
Our privacy program incorporates leading regulatory requirements, including GDPR and India's Digital Personal Data Protection (DPDP) Act 2023, helping ensure data is handled responsibly, transparently, and lawfully.
Secure-by-Design Infrastructure
Logically Isolated Client Environments
ELYX runs as a multi-tenant platform in which every customer's data is held within a logically isolated environment. This architecture provides:
- Strict logical separation between tenants
- Encryption in transit and at rest
- Network-level segmentation
- Protection against cross-tenant data exposure
- Enhanced operational control and resilience
Enterprise-Grade Security
Our platform is hosted within a secure Microsoft Azure environment protected by layered security controls, including internal firewall protections, network security monitoring, infrastructure hardening standards, and high-availability and failover capabilities.
We also support deployment configurations designed to meet customer-specific residency, compliance, and business continuity requirements.
Access Control & Accountability
Access to customer information is restricted to authorized personnel with a legitimate business need.
ELYX applies the principle of least privilege through comprehensive Role-Based Access Controls (RBAC), ensuring users receive only the access necessary to perform their responsibilities. Key controls include granular user permissions, segregation of duties, approval workflows, continuous monitoring, and comprehensive audit trails.
These controls support compliance requirements, incident investigations, and operational accountability.
Data Minimization & Anonymization
Where possible, sensitive information is transformed to reduce exposure while maintaining analytical value. Our privacy-enhancing techniques include salted SHA-256 hashing, tokenization, data masking, and pseudonymization.
These controls help ensure that sensitive identifiers remain protected, even when data is used for analytics.
Data Residency & Customer Choice
Organizations operate under varying regulatory and operational requirements regarding where data is stored and processed. ELYX provides deployment options that support geographic data residency requirements, regional hosting preferences, logically isolated environments, high-availability configurations, and business continuity objectives.
All deployments maintain the same rigorous security and privacy standards.
Why It Matters
Identity and security data is among the most sensitive information an organization holds. Maintaining trust requires more than security controls. It requires governance, accountability, and transparency.
ELYX combines industry-recognized security frameworks, privacy-first architecture, and logically isolated customer environments to help ensure that innovation never comes at the expense of confidentiality, integrity, or compliance.
Common Questions
Frequently Asked Questions
Contact Us
Have questions about our security, privacy, or compliance practices? Our Security and Compliance team is available to provide additional information and discuss your specific requirements.
contact@elyxsecurity.com