Build on infrastructure you can trust
Delalify protects your Conjoin data with security controls for encryption, access, infrastructure, and privacy, and monitors each control continuously to confirm that it works.
How we protect your data
Each category below lists the controls that protect your data at that layer of our stack.
Data protection
We encrypt your data whenever we store it or send it, while you choose the region where we keep it.
Encryption at rest
We encrypt all the data that we store with AES-256.
Encryption in transit
Our servers encrypt every connection with TLS 1.3 when your client supports it and fall back to TLS 1.2 for older clients.
Backup and recovery
We back up your data every day and keep the copies in geographically separate locations. With point-in-time recovery, we can restore a database to its state at any moment that you choose before an incident.
Data residency
On plans that include a choice of region, we store your data in the region that you select, so that you can meet the residency rules that apply to your organization.
Identity and access
You decide who can do what on your account, while our audit log records every action that anyone takes there.
Role-based access control
You set which roles can view, edit, or manage each resource in your account.
Multi-factor authentication
You can turn on MFA for any account, while we require it by default for every administrator.
Least-privilege access
We give each employee access only to the internal systems that they need for their job. Under our zero-trust model, each of those systems checks the employee's identity on every request.
Audit logging
We record every sign-in, every permission change, and every access to your data in an immutable audit log.
Infrastructure
We defend the systems that host your data at the network edge and patch them automatically.
Network security
A web application firewall with DDoS protection filters the traffic to every public service. Inside our network, we separate workloads into segments so that each workload can connect only to the systems that it depends on.
Continuous monitoring
We watch every service for unusual activity as it happens, so that our automated defenses can respond at any hour of the day.
Incident response
Our on-call engineers follow documented runbooks, so they triage an incident within minutes of the first alert.
Uptime
We target 99.95% availability for production services, while an Enterprise contract can include multi-region deployment with automated failover.
Organizational
We vet the vendors and the employees who handle your data and put every production change through review.
Vendor management
We review the security of each third-party vendor before we sign with them and again every year after that.
Employee security
We check the background of every employee before they join and train each one in security awareness. We also install endpoint protection on every work device that our employees use.
Change management
Before we release a change to production, a second engineer reviews the code while our automated tests check its behavior. We then roll the change out in stages, so that we can stop a faulty release before it affects every customer.
Privacy
You set how long we keep your data and can answer privacy requests about it from inside the product.
Data handling
Our published data processing agreement states how we collect, store, and process your data.
Retention policies
We delete each kind of data securely once the retention period that you set for it ends.
Subject rights
With our built-in tools, you can handle requests to access, correct, export, or erase personal data under GDPR and similar laws.
Subprocessor oversight
We publish a list of our subprocessors and add each new one to the list before we engage it.
Compliance frameworks
We comply with the data protection laws below today, while we prepare for formal audit certifications.
GDPR
General Data Protection Regulation
Ghana DPA
Ghana Data Protection Act, 2012 (Act 843)
Our compliance approach
We monitor every control continuously in Vanta, a trust management platform that collects compliance evidence automatically and updates our compliance status as each control changes. Until our formal audits are complete, we share that evidence with prospective customers on request.
Delalify operates Conjoin on the same infrastructure, under the same security controls and compliance program, as the Delalify apps.
SOC 2
Trust Services Criteria
ISO 27001
Information Security
EU-US DPF
Data Transfer Framework
Security documentation
Review our published legal documents or request additional security materials for your procurement review.
Request additional documentation
If your team needs to review our security before it buys from us, we can share our security overview, help you complete your questionnaire, or send our compliance documents under an NDA. Our team follows up directly on every request that you send by email.
Tell us which documents you need, the name of your company, and the date when your review closes.
conjoin@delalify.comFrequently asked questions
These answers cover how Delalify secures Conjoin, which compliance frameworks it follows, and what happens to your data.
Have a security question?
Our security team can walk you through the controls behind Conjoin, send you our documentation, or help you complete your vendor assessment.