Security
Your agency's data is not in a shared table.
Most multi-tenant software puts every customer in the same tables and adds a column to tell them apart. One missing clause in one query and an agency reads somebody else's roster. Zawrix does not work that way.
Implemented today
What the code actually does.
- 01 A database schema per agency Separation at the database, not in application logic. A query that does not say which agency it is for fails outright rather than quietly falling back to a default.
- 02 An isolation suite on every change An automated test whose entire job is to try to read one agency's data as another. It runs before anything ships and is treated as able to end the company if it breaks.
- 03 Identity numbers encrypted, reads logged Social Insurance Numbers are encrypted at rest under a key held per agency, never rendered on a public page, never sent to a client, and every read is written to an access log with a name against it.
- 04 Your names, your certificates Office app, worker portal and website run on your own hostnames, each with its own certificate issued on the first request. No shared vendor domain in front of your clients.
- 05 Support access leaves a mark Opening your account requires a stated reason and an expiry, and it is written to a log — so the answer to "who can see our data" is a record rather than a reassurance.
- 06 An audit trail that holds up Who was placed where, who verified which document and when, who changed a rate, who opened an account. Not because anyone enjoys audit trails, but because the day you need one you need it complete.
How the separation works
A column you might forget, or a wall you cannot.
The distinction is where the mistake is possible. One design puts it in every query anybody ever writes. The other puts it in one place, once.
The usual arrangement is a single set of tables with a customer identifier on every row, and a promise that every query filters on it. That promise is kept by hand, in hundreds of places, forever — and it only has to be broken once, by one developer in a hurry, for an agency to read somebody else's roster.
Zawrix gives each agency its own database schema. A request resolves which agency it is for before it reaches any code that can read data, and the connection is pointed at that schema for the duration. A query that has not been told whose data it wants does not fall back to a default — it fails.
That is the difference between a rule and a wall. It costs more to operate: migrations run per agency, and provisioning is a real step rather than an insert. We think that is the correct trade for the one failure nobody recovers from.
Where things are
The answers a technical reviewer asks for first.
- Hosting
- The application runs on infrastructure in Toronto, Canada. We will confirm the exact region of every component in writing for a review, rather than asking you to take a marketing page's word for it.
- Database
- A managed PostgreSQL cluster, with one schema per agency. The connection between the application and the database is encrypted.
- Subprocessors
- Hosting and the managed database sit with one infrastructure provider. The optional careers-page assistant sends visitor messages to a third-party model. Email, when configured, adds a delivery provider. That is the list; there is no analytics vendor, no session recorder and no advertising pixel anywhere in the product or on this site.
- Identity numbers
- Encrypted at rest under a key held per agency, never rendered on a public page, never sent to a client, and every read written to an access log with a name and a time against it.
- Backups
- Taken by the managed database provider. We have not yet rehearsed a full restore end to end, so we are not going to describe a recovery time we have not measured. When we have run one, this row will say when and what it took.
- Deleting a worker
- Their record and documents can be removed. Invoices and placements that actually happened are accounting records and survive, because no privacy regime requires a business to forget that it was paid.
- Support access
- Opening your account requires a stated reason and an expiry and is written to a log. The answer to who can see your data is a record you can read, not a reassurance.
Procurement
The certification questions, answered before you ask.
Zawrix holds no SOC 2 report, no ISO 27001 certification and no third-party penetration test, and publishes no uptime figure or data-residency guarantee beyond telling you exactly where the infrastructure runs. Every one of those is a document with a date and a scope, and we will list them here when they carry ours rather than describing them in the meantime.
If your procurement gate requires one of them today, you will want to know that now rather than four weeks into an evaluation — which is why it is on the page instead of in a questionnaire response.
What we will do today: answer a security questionnaire honestly, walk a technical reviewer through the isolation model and the access logs, and put the answers in writing.
Questions
Including the ones with uncomfortable answers.
Is our data used to train anything?
No. There is no model being trained on your records, and the candidate matching contains no model at all — it is published arithmetic.
The one place data leaves our infrastructure is the optional assistant on your careers page, which sends a visitor's own message to a third-party model to answer it. Your pool, your clients and your invoices are not in that request.
Do you have SOC 2 or ISO 27001?
No. Neither, and no third-party penetration test either. We are not going to imply otherwise with a badge that links to a policy page.
If your procurement requires one, we are not the right supplier yet, and we would rather you learned that here than four weeks into an evaluation.
What is your uptime?
We do not publish one, because we have not been running long enough for a figure to mean anything, and because nothing external is currently watching. A process running on the same machine cannot credibly report that machine being down.
That is stated inside the product too — the configuration screen in our own console says availability is unmonitored rather than showing a green tick.
What happens if there is a breach?
You are told, with what we know and when we knew it, and you are told before we have finished being embarrassed about it. We are a small company; you will hear from a person who was there.
We do not have a published incident-response programme with named severities and stated timelines, and inventing one for a web page would be the least useful thing we could do.
Can our IT team review the isolation model?
Yes, and we would prefer it. We will walk a technical reviewer through how a request resolves to an agency, what happens to a query that has not been told whose data it wants, and what the access logs contain — and put the answers in writing.
Who at Zawrix can see our records?
Opening a customer account requires a stated reason and an expiry, and it is logged. That is a smaller claim than "nobody" and it is the true one: somebody has to be able to help you at nine on a Friday, and the honest control is a record of when they did.
Send us your security questionnaire.
We will answer it as it stands, including the blanks.