Security at ExpertEase AI
This page summarises our security architecture and controls. A full Security Whitepaper and Data Processing Agreement are available on request at security@experteaseai.com
Shared Responsibility with Microsoft Azure
All production infrastructure runs on Microsoft Azure's Australian regions — Australia East (Sydney) and Australia Southeast (Melbourne) — certified to ISO/IEC 27001, SOC 1/2/3, and IRAP-assessed for Australian Government workloads. ExpertEase AI inherits Microsoft's physical and platform-layer controls and is responsible for the application, identity, and data-handling layers.
| Layer | Responsible Party |
|---|---|
| Physical data centres, hardware, hypervisor | Microsoft Azure |
| Network infrastructure, platform patching, storage encryption | Microsoft Azure |
| Application security, secure development, vulnerability management | ExpertEase AI |
| Identity, access control, and tenant isolation | ExpertEase AI |
| Customer data handling, retention, and deletion | ExpertEase AI |
| AI governance and model orchestration | ExpertEase AI |
| Account credentials and user access | Customer |
Platform Security Controls
Encryption Everywhere
TLS/HTTPS with HSTS on every endpoint. All internal service traffic encrypted. Sensitive fields (API keys, OAuth tokens, integration secrets) receive additional field-level AES encryption with keys held in Azure Key Vault — unreadable even in a raw database dump.
Strict Tenant Isolation
Every knowledge-base search, database query, and integration credential is scoped by customer identifier. One customer's AI agent can never retrieve another's knowledge. Tenant-scoping code changes require mandatory architect review before release.
Identity & Access
Short-lived rotating access tokens; OAuth sign-in via Google, Microsoft, and Zoho. Admin access requires multi-factor authentication and is limited to authorised ExpertEase staff. All inbound webhooks are cryptographically verified before processing.
Network & App Security
CORS allow-listing, CSRF protection, automated rate-based abuse detection, and IP reputation screening. Internal AI and crawling services are not reachable from the public internet. Automated security scanning on every CI/CD build; production deployments require senior-engineer manual approval.
Monitoring & Observability
Distributed tracing and centralised logging across all services via Azure Application Insights and Log Analytics. External uptime monitoring from multiple regions, independent of our own infrastructure. Every AI interaction traced for quality and auditability.
Resilience & Backups
Automated daily database backups with point-in-time recovery. Redis cache replication. Knowledge-base indexes rebuildable from source files. Background tasks queued durably with automatic retry. RPO and RTO targets reviewed annually.
Secure Development
Every build passes automated security scanning in our CI/CD pipeline. Production deployments require senior-engineer code review and manual approval. Our development practices align with OWASP standards — including the OWASP Top 10, OWASP API Security Top 10, and OWASP LLM Top 10 for AI-specific risks such as prompt injection and data leakage.
Development environments are fully isolated from production with distinct domains, credentials, and secrets. No customer data ever flows to non-production environments.
OWASP Alignment
Responsible Disclosure
If you believe you have found a security vulnerability in ExpertEase AI, please report it to security@experteaseai.com. We investigate all reports, acknowledge within 2 business days, and appreciate good-faith research.
Need Our Security Pack?
Security whitepaper, DPA, sub-processor register, and completed security questionnaires — available under NDA for procurement and legal reviews.
Request the Security Pack →