Signed URLs for every capture
Screenshots, screen recordings and any binary artifact are served only through short-lived signed URLs (exp / nonce / sig). Direct object access requires a valid signature — no raw filesystem exposure.
Security & privacy
Monitoring your legal team signs off on.
Status Quo 247 is built consent-first and audit-everything. Role-scoped by default, transparent to the people being measured, and honest about what's shipped versus what's on the roadmap.
Security pillars
Role-based access with SSO + SCIM
Eight system roles (Super Admin, Admin, Manager, HR, Employee, HR Payroll, Finance Payroll, Payroll Checker) plus custom roles built from a granular resource:action permission catalog. SAML SSO and SCIM 2.0 user provisioning on Enterprise.
Full audit trail, CSV export
Every sensitive admin action — user changes, permission grants, policy edits — is captured in an append-only audit log. Filter, search, and export to CSV from the platform panel.
Per-org isolation
Multi-tenant by design. Every table is orgId-scoped and every request is pinned to the caller's org by a global interceptor — one org's data is never queryable from another's session.
Configurable data retention
Per-org retention windows for captures (90 days default), audit logs (365), system-info snapshots (30) and geo-IP records (90). A nightly prune scheduler enforces the policy — expired rows are permanently deleted, not soft-hidden.
Consent-forward
First-launch consent lists the current policy version and exactly what's captured. Consent state (accepted / withdrawn) is stored per-employee. Stealth vs Visible mode is a single explicit org-level policy — no hidden default.
Privacy by design
Accountability without the creep factor.
Monitoring only earns trust when it's transparent. Status Quo 247 is built so employees know what's measured, managers see only what their role allows, and every sensitive action leaves a trace.
- Explicit, logged consentCapture requires a stored acceptance record tied to the employee and policy version.
- Idle-awareCapture pauses automatically after configurable idle threshold (default 5 minutes).
- Least-privilege by defaultTeam-scope permissions like `employee:view-team` let managers see only their reports.
- Field-level payroll encryptionSalary, PAN, Aadhaar and other statutory fields are encrypted with AES-256 keys held outside the database.
Certifications
Where we are, and where we're going.
We won't claim a certification we haven't earned. Here's the honest picture — send us your security questionnaire and we'll answer it point by point.
Available today
- Data Processing Agreement (draft) — GDPR / UK-GDPR / DPDP aligned
- Privacy Policy & Cookie Policy
- Architecture & data-flow docs on request
- Sub-processor list (per DPA)
On the roadmap
- SOC 2 Type I — planning phase
- Independent penetration test
- ISO 27001 — evaluating
Reviewing us for procurement?
DPA, architecture overview and a walkthrough with an engineer — on request.
Security FAQ
What enterprise buyers ask us most.
Is Status Quo 247 GDPR compliant?
Yes. We operate under GDPR as data processor for your organization's employee data. We sign a Data Processing Agreement (DPA), maintain a Record of Processing Activities, honor Data Subject Access Requests, and support the right to erasure. See our /legal/dpa page for the standard DPA text; enterprise customers can negotiate custom terms with legal@statusquo247.com.
Where is our data stored?
By default, in AWS ap-south-1 (Mumbai). We can provision your tenant in EU (eu-west-1, Frankfurt) or US (us-east-1) regions on Enterprise plans. Data never leaves the region you provision in.
How is data encrypted?
In transit: TLS 1.3 with modern ciphers only, HSTS on every subdomain. At rest: AES-256 on Postgres storage, application-level field encryption on sensitive payroll data (bank details, tax IDs) using per-org keys.
Who inside Status Quo 247 can access our data?
Only a small number of platform operators, with just-in-time access that expires in 30 minutes and is logged in an immutable audit trail. Every operator action against a tenant is recorded and available to you on request. No engineer has standing access to production customer data.
Do you have SOC 2 or ISO 27001?
SOC 2 Type II is in-progress; report expected Q3 2026. ISO 27001 is on the roadmap for 2027. For deals that need proof-of-controls today, we can provide our security questionnaire responses, penetration test results, and a signed DPA. Reach security@statusquo247.com.
What happens to our data if we cancel?
You can export everything via the admin panel or API before cancellation. After cancellation we retain per your plan's retention window (30 days on Growth, up to 12 months on Enterprise), then permanently delete. Backups are purged within 35 days of primary deletion.
How do you handle security incidents?
We follow a standard incident response process: detection → containment → notification to affected customers within 72 hours (as GDPR requires) → post-mortem shared with impacted customers. Our status page publishes incidents in real time.