Security
What we hold, what we store, who can reach it and where it runs. Written to be checked against a security questionnaire rather than skimmed.
What we hold, and what we do not
We are certified to ISO 27001 for information security management.
Execution is zero data retention. The data you send to a decision is used to make that decision and passes straight through - it is not retained here, and it is never used to train models. What we keep is the execution logic itself, with its full revision history, plus the platform audit log of who did what in the portal. Put plainly: we hold the formulas, not the numbers. Execution traces, the record of what each decision actually did, are written to infrastructure you control - which is what lets a decision be reconstructed months later against the exact version of the logic that made it.
Controls, on every plan
None of these is reserved for an enterprise tier. Charging extra for the controls that keep an account safe is a practice we would rather not copy.
Single sign-on and two-factor authentication
SSO for identity you already manage, plus two-factor authentication. Both are included on every plan, not gated behind an enterprise tier.
IP restrictions
Restrict portal access to the networks you name, so a valid credential is not enough on its own from an unknown address.
Role-based access rights
Rights are granted per role, so an analyst who builds decision logic and a reviewer who approves a release do not need the same access. Approval sequences mean nobody can ship a release alone.
Encrypted credential vault
Bureau and provider credentials live in an encrypted vault with step-up authentication and key rotation. They point at your own contracts with those providers - we do not sit between you and them commercially.
Audit log
Every view, edit, test, export, deployment and login is recorded with actor, tenant, IP address and correlation id. It covers human actions in the portal, not only what the engine executed.
Where your data lives, and how you get it back
Decisions in lending, insurance and onboarding touch the most sensitive data you hold. The answers here are concrete rather than reassuring.
- Regional execution endpoints. You choose the region decisions run in, for latency and for residency, without cross-border transfers you did not ask for.
- Execution in your own environment. An execution node can run in your own infrastructure on request; the design authority stays in the portal.
- Decision results in a database you own. Configure a sink to your own Postgres and the results of your decision logic are written into a table in infrastructure you control.
- Your logic exports as a Markdown file. Readable, portable structure - not compiled bytecode you could never reconstruct without us.
Questions a security review asks
Do you store our customer data?
No. Execution runs on zero data retention: the data passes through to make the decision and is not kept here. We retain the execution logic with its revision history, and the platform audit log of actions taken in the portal - not your customer data. Execution traces are written to infrastructure you control, and decision results can stream continuously into a Postgres database you own.
Do you train AI models on our data?
No. Your data is not used to train models, ours or anyone else’s.
Can we restrict where decisions are executed?
Yes. Execution endpoints are regional and you choose the region. If that is not enough, an execution node can run inside your own environment on request.
Is SSO an enterprise add-on?
No. SSO, two-factor authentication and IP restrictions are on every plan. Charging extra for the controls that keep an account safe is a practice we would rather not copy.
Who at Decisimo can see our environment?
Access is role-based, and every view is written to the audit log with actor, IP and correlation id. That log is available to you, so the question is answerable with evidence rather than assurance.
What happens to our data if we stop using Decisimo?
Your decision results are already in your own database if you configured the sink, and your decision logic exports as a Markdown file. There is no extraction project to negotiate at the point you have decided to leave.
Assessing us for DORA or the EU AI Act?
This page covers the controls. The governance page maps them to what those regimes actually ask you to evidence, obligation by obligation.