Authentication & Access
SonicCx currently supports email and password authentication. Additional authentication methods are technically achievable and on our roadmap, but are not yet live.
- Email and password authentication — live today
- Two-factor authentication (2FA) — roadmap
- Google and social login — roadmap, via Firebase Authentication
- Session-based access control
Access Control
Access is enforced at the application and database level through structured rules, so users interact only with the data relevant to their role and project.
- Role-based access enforced through our database security rules
- Logical separation of data by role and project
- Finer-grained permission tiers (delegation, time-limited access, approval-gated roles) are on our roadmap
Data Isolation
Project and organisation data is logically separated within our database structure, so one organisation's data is not exposed to another by design.
- Logical data separation between organisations
- No shared data exposure between tenants by design
- Dedicated per-tenant encryption keys, dedicated data residency, and on-premise/private cloud deployment are not currently offered
Data Governance
We are formalising our data governance framework as the platform matures, including data retention, classification, and portability.
- Data export in open formats
- Data retention and deletion policies — in development
- Formal GDPR / Privacy Act compliance controls and data residency options — roadmap, not yet certified
Audit Trails
Activity within SonicCx — who did what, and when — is recorded to support project accountability. Formal, regulator-grade audit export is on our roadmap.
- Activity logging for key project actions
- User access records
- Immutable/tamper-proof audit logging and structured regulatory export — roadmap, not yet certified
Encryption
Data in transit is encrypted using industry-standard HTTPS/TLS. SonicCx is built on Google Cloud infrastructure (Firebase / Google Cloud Identity).
- HTTPS/TLS encryption in transit
- Hosted on Google Cloud infrastructure
- Formal at-rest encryption specification, dedicated key management, and certificate policy documentation are being finalised for independent review
Infrastructure & Reliability
SonicCx runs on Google Cloud infrastructure. The platform has not yet completed a formal, independent stress test in a live production environment at scale — that testing is planned as part of our security roadmap.
- Hosted on Google Cloud infrastructure
- Formal uptime SLA, multi-region failover, WAF/DDoS protection, and 24/7 monitoring are not yet in place
- Load and resilience testing planned ahead of broader enterprise rollout
Certification & Verification Roadmap
SonicCx has not yet completed independent security certification. We are working toward formal verification of our security architecture before making compliance claims.
- Independent verification of security controls — in progress
- SOC 2 / ISO 27001 / IRAP and similar certifications — not yet obtained
- Formal penetration testing and disaster recovery testing — planned
- We'll share our current architecture and roadmap directly with your security or procurement team on request
Talk to us directly about security.
We don't yet have formal certification documentation to share — but we're happy to walk your IT or procurement team through exactly what's built, what's planned, and our timeline for independent verification.