Managed Cloud Security
Security, privacy, compliance, and AI governance.RightCrowd SmartAccess Managed Cloud is a physical identity and access management (PIAM) platform. Our approach to security and privacy combines layered controls, configurable privacy settings, continuous vulnerability scanning, and annual independent penetration testing, with executive and board-level oversight.
Learn how we protect your data, support privacy requirements, maintain our security certification, and give you control over how RightCrowd AI is used.
Layered security controls
RightCrowd SmartAccess Managed Cloud applies security controls across identity, network, application, data, and monitoring.
Identity and access
Single sign-on (SSO) integration connects RightCrowd SmartAccess Managed Cloud with your identity provider. Granular role-based permissions support least-privilege access, and multi-factor authentication (MFA) is required for administrative access.
Network protection
Network segmentation and firewall controls protect Managed Cloud environments. All network traffic is encrypted in transit using TLS 1.2 or higher. Backend infrastructure is not directly accessible from the public internet.
Secure development
Code changes require peer review. Automated security scanning is integrated into the deployment pipeline, supported by continuous vulnerability scanning and independent penetration testing.
Data protection
Customer data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Each customer’s data is logically isolated from other tenants. Documented retention and secure disposal procedures govern the handling of customer data.
Monitoring and response
Automated monitoring and alerting operate across the platform around the clock. Full audit records provide visibility into changes and the users responsible. A documented incident response process guides investigation, escalation, and mandatory customer notification.
AI transparency and control
RightCrowd AI is built into RightCrowd SmartAccess Managed Cloud. It helps users find answers, explore data, build rules, and prepare access, credential, and visitor requests through conversation.
Customer-controlled use
AI capabilities are disabled by default. Customers decide which capabilities are available and who can use them.
Bring Your Own Model (BYOM)
Customers choose and connect the AI model endpoint approved for their organization. Model-provider data practices depend on the provider and configuration selected.
Existing permissions and processes
RightCrowd AI operates within existing permissions, policies, approvals, validation, workflows, and audit processes. Customer-defined policies, validation, approvals, and workflows remain in force. Users can access only the information and functionality permitted to them.
Human review and confirmation
RightCrowd AI can help investigate information, draft rules, and prepare requests. Users review and confirm consequential changes before they take effect. Existing approval requirements continue to apply.
Read-only reporting
Natural-language reporting uses read-only access to RightCrowd SmartAccess data to return answers and custom charts and graphs based on the user’s questions.
Privacy and data residency
Customers can select hosting in the United States, the European Union, or Australia when establishing their RightCrowd SmartAccess Managed Cloud deployment.
Hosted in the United States
Hosted in the European Union
Hosted in Australia
Production data, backups, and processing remain within the selected hosted geography for the life of the tenant.
Configurable privacy settings
Privacy settings can be configured for each deployment without code changes.
Field-level privacy controls
Role-based visibility restricts access to private fields, while masking controls limit the exposure of personally identifiable information.
Import controls
The RightCrowd Transform capability can remove sensitive or unnecessary fields from source-system data before it enters the platform.
Regional configuration
Retention, access rules, workflows, and audit reporting can be configured by business unit, legal entity, or country to support organizational and regional requirements.
Privacy framework
Our Data Privacy Framework aligns with GDPR, the Australian Privacy Act, and CCPA. A Data Processing Agreement is available on request.
For more information about personal data handling, review the RightCrowd Privacy Policy.
Certifications and compliance
ISO/IEC 27001:2022
The RightCrowd Information Security Management System (ISMS) is certified to ISO/IEC 27001:2022, the international standard for information security management systems. Certificate CAS5252 is issued by Compass Assurance Services. Certification is maintained through annual surveillance audits and recertification every three years.
Certificate
CAS5252
Issued by
Compass Assurance Services
Surveillance audits
Annual
Recertification
Every three years
SOC 2 Type II
GlobalA SOC 2 Type II audit is in progress.
Penetration testing
AnnualIndependent penetration testing is conducted annually. A summary of the results is available on request.
Cyber insurance
RightCrowd maintains cyber insurance. Evidence of coverage is available on request.
Availability and recovery
Recovery targets address potential data loss and the time needed to restore service following a disruption.
Uptime SLA
Subject to the applicable service agreement
Recovery Point Objective
The target maximum period of data loss
Recovery Time Objective
The target time to restore service
Transaction log backups
Approximate backup interval
Managed infrastructure
RightCrowd SmartAccess Managed Cloud runs on Microsoft Azure Kubernetes Service infrastructure, supporting automated scaling and high availability. RightCrowd manages server and application maintenance, monitoring, backups, and software updates.
The production service carries a 99.9% uptime SLA, subject to the applicable service agreement.
Support follows a follow-the-sun model across Europe, Australia, and the United States.
Backup and disaster recovery
Backups are encrypted using AES-256 and are geographically redundant.
Full backups
Weekly
Differential backups
Daily
Transaction log backups
Approx. every 10 minutes
Backup retention
Configurable, typically 7–35 days
Disaster recovery testing
Annual
Request documentation
Available documentation includes the ISO/IEC 27001:2022 certificate, a summary of the latest independent penetration test, and a cyber insurance certificate.
ISO/IEC 27001:2022 certificate
Penetration test summary
Cyber insurance certificate