Security built into every layer

All traffic between your device and ChangeAIQ is encrypted with modern TLS (HTTPS), and all data is stored encrypted at rest. Images, reports and account information are never visible in plain text — in transit or at rest.

• TLS 1.2+/HTTPS on every page and API, with HSTS enforcing encryption
• At-rest encryption for databases and file storage
• No secrets or keys in the code delivered to your browser

Every organisation and every user can only reach their own data. Isolation is enforced inside the database itself with row-level security (RLS) — not just in the app — so even a software bug cannot leak data across customers.

• Row-level security (RLS) on every table holding customer data
• Over 1,400 automated tests attempt to bypass the boundaries — every single one is blocked
• Tampered requests with forged IDs, filters or sorting are always rejected

You decide who gets access, and with which role. Invitations are signed and expire, owner roles can only be granted by owners, and every role change is written to an audit log you can go back through.

• Owner, administrator and member roles with clear boundaries
• Invitation-based onboarding with expiring, unique links
• A complete audit trail of roles, invitations and access changes

Sign-in is protected against password guessing, session hijacking and forged requests. Cookies are secure and unreadable to malicious code, and every state-changing call requires a valid CSRF token.

• Rate limiting on sign-in and invitations stops brute-force attacks
• CSRF token validation on every state-changing request (POST/PUT/PATCH)
• HttpOnly, Secure and SameSite protected sessions
• Two-factor authentication is available for accounts that want extra protection

ChangeAIQ runs on certified, professional cloud infrastructure with built-in protection, automatic security patching and continuous operations — the same class of platform used by thousands of business-critical applications.

• Infrastructure certified to SOC 2 Type II and ISO 27001
• Automatic scaling, DDoS protection and platform security patching
• Backups and isolated runtime environments for every application

The application is actively hardened against the most common web attacks: script injection (XSS), clickjacking, database injection, SSRF and attempts to bypass access rules with forged parameters.

• Strict Content-Security-Policy, X-Content-Type-Options, frame and referrer protection
• Input is validated and normalised — control characters, double encoding and duplicates are rejected
• SSRF protection on every user-supplied URL (such as camera addresses)
• Automatic scanning for known vulnerabilities in all software dependencies

Suspicious events are logged and analysed continuously: failed sign-ins, blocked requests, rejected parameters and CSP violations. Patterns that suggest an attack immediately email the owners.

• Security log with filtering, export and per-event detail
• Automatic alerts for brute-force patterns and abuse
• CSP violation reports are collected and analysed to catch injection attempts

Every code change passes through an automated security gate before it can be released: static code analysis (SAST), dynamic attack testing (DAST), penetration tests and more than 1,400 access and bypass tests. A single failure blocks the release.

• SAST/DAST and penetration tests run on every change
• 1,400+ tests attempt to read other people's data via tampered requests — all blocked
• A role and access matrix tests owners, administrators and regular users
• A browser matrix verifies everything works identically in Chrome, Safari, Firefox and Edge

ChangeAIQ is Norwegian-owned and GDPR compliant. We only collect what is needed to deliver the service, you own your own data, and you can export or delete it at any time.

• Detailed cookie consent — nothing is tracked without your choice
• Clear privacy policy and terms of use in Norwegian and English
• Data is never shared with third parties without a purpose

If you find a security issue, we want to know. We have an established reporting channel and a published security.txt, so security researchers know exactly how to reach us.

• Report vulnerabilities to security@changeaiq.com
• A public /.well-known/security.txt with contacts and guidelines
• We respond quickly and handle every report confidentially