Security
Authentication, authorization, tenant-aware access, sessions, MFA, application protection, edge controls, logging, and disclosure.
Review securityTrust Center
Review the controls before operating data enters the workspace.
Commandix can hold strategic, project, task, people, sales, and audit-related records. Buyers should inspect access, data handling, privacy, and operating controls early.
Review areas
Open the evidence tied to the question.
Public pages provide the baseline. Deployment-specific answers and contract terms belong in the procurement review.
Privacy
Data categories, purposes, rights, retention, sharing, and request intake.
Review privacyGDPR readiness
Controller and processor roles, rights assistance, DPA path, subprocessors, and transfer questions.
Review GDPR readinessSOC 2 readiness
Current control mapping and evidence planning. Commandix does not claim SOC 2 certification.
Review readiness mappingDPA overview
Processing instructions, confidentiality, security measures, assistance, and deletion or return.
Review DPA overviewSubprocessors
Public vendor categories and the path to a deployment-specific list.
Review subprocessorsControls
Named controls are easier to review than broad assurances.
The deployment review should confirm which controls are enabled, who operates them, and what evidence exists.
| Area | Public posture | Review |
|---|---|---|
| Identity and access | Passwords, supported OAuth paths, MFA, sessions, roles, section access, tenant-aware routes | Access controls |
| Application protection | Authenticated routes, request validation, CSRF controls, rate limits, and security headers | Application controls |
| Infrastructure edge | Nginx, HTTPS, HSTS, certificate management, firewalling, and scanner controls | Infrastructure controls |
| Privacy operations | Rights intake, export paths, public policies, DPA overview, and subprocessor disclosure | Privacy operations |
| Connection data flows | Identity, calendars, notifications, and deployment-gated engineering work | Connection boundaries |
Need deployment-specific evidence?
Send the questionnaire, DPA redlines, enabled connection list, regions, retention needs, and required contract terms.