Trust & Infrastructure

Security & Data Protection

Enterprise Assurance • Last Reviewed: September 14, 2026

CRYPTOGRAPHY

Data Encryption

All data is encrypted in transit via TLS 1.3 with forward secrecy and at rest with AES-256 encrypted storage volumes and KMS key rotation.

ARCHITECTURE

Tenant Isolation

Logical schema and database boundary partitioning guarantee zero cross-tenant visibility or co-mingling of operational workloads.

IDENTITY

Zero-Trust Access

Role-Based Access Control (RBAC), multi-factor authentication (MFA/SSO via SAML 2.0 / OIDC), and ephemeral credential lifecycles.

OPERATIONS

Continuous Monitoring

Real-time SIEM logging, anomaly detection, DDoS mitigation via Cloudflare/AWS Shield, and automated compliance auditing.

1. Infrastructure & Cloud Provider Security

TwoWorks leverages Tier-4 hyperscale data centers (AWS, GCP, and Azure) located in sovereign geographic regions specified by enterprise contract. Cloud infrastructure providers maintain certifications including ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, and PCI-DSS Level 1 compliance. Physical security controls include biometric access, continuous surveillance, and redundant uninterruptible power systems.

2. Vulnerability Management & Penetration Testing

Third-Party Penetration Tests: Independent CREST-certified security firms conduct comprehensive black-box and grey-box penetration assessments bi-annually.
Automated CI/CD Scans: Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) inspect all code commits and container images prior to production deployment.
Patch Management: Critical zero-day security patches are applied within 24 hours of vendor publication.

3. Business Continuity & Disaster Recovery (BCP/DR)

Our distributed platform utilizes multi-region active-passive replicas and automated incremental snapshot pipelines:

Recovery Point Objective (RPO): < 15 minutes for primary database clusters.
Recovery Time Objective (RTO): < 2 hours in the event of an entire regional data center outage.
Backup Testing: Automated integrity checks and restoration drills are validated weekly.

4. Responsible Disclosure Program

If you believe you have identified a potential vulnerability in any TwoWorks service or infrastructure component, we welcome your disclosure. Please notify our Security Incident Response Team immediately at security@twoworks.co. Include detailed reproduction steps and logs; we commit to acknowledging submissions within 24 hours.