Built With Security as a Foundation, Not an Afterthought
Designed in from day one of development, not bolted on after.
permitOS™ is currently in development ahead of its Fall 2026 launch. Security isn't a feature we're planning to add later — it's part of how the platform is being architected from the ground up, alongside every other part of the system.
This page describes how permitOS is designed to protect your permitting data. We've written it the same way we write everything else on this site: plainly, and without claiming more than we can back up. We'll update it as development continues and as we complete additional testing and validation ahead of launch.
Security built into the architecture, not layered on top of it.
Tenant Data Isolation
Your company's data is logically separated from every other company's data at the database level, so one customer's records are never visible to another.
Role-Based Access Control
Access is scoped by role and by record — what someone can view, create, or edit is controlled down to the individual project, not just the account.
Defense in Depth
Access rules are enforced independently at both the application layer and the database layer, so a mistake in one layer doesn't expose data on its own.
Encrypted Connections
Connections to permitOS are designed to run over encrypted HTTPS connections, protecting data as it moves between your browser and our servers.
Full Activity Accountability
Meaningful actions in the system are designed to be attributable to a specific person and timestamp, so there's a clear record of who did what.
Scoped, Rotating API Credentials
API keys issued to integration partners are scoped to only the data they need, expire by default, and can be rotated without downtime.
Built for launch, not bolted on after the fact.
As part of preparing permitOS for its Fall 2026 launch, the platform's design includes:
- –Strict security headers and a locked-down cross-origin policy
- –No verbose error messages or framework details exposed to the public
- –Admin tools isolated on a separate, network-restricted path
- –Rate limiting and bot/abuse detection at the network edge
- –Scheduled credential rotation, with immediate rotation if anything is ever suspected compromised
- –Security-event monitoring designed to flag unusual account activity for review
These are standard, well-established practices — we're not claiming anything exotic. We'd rather be boring and correct than impressive and vague.
What we've done — and what we haven't done yet.
permitOS has completed a detailed internal security architecture review, covering how data is classified, stored, and exposed across the system, along with a security test suite built to run as part of our development pipeline. That's real, completed work — and it's also self-conducted, internal work.
We have not yet completed a third-party security audit or penetration test, and permitOS does not currently hold compliance certifications such as SOC 2 or ISO 27001. If that changes, we'll update this page to say so — and until it does, we won't imply otherwise.
Our path to launch.
Architecture & Security Design Review
Completed. The data model, access controls, and API surface were reviewed for exposure risk before a single line of the application was built.
Build & Internal Testing
In progress. The platform is being built against the security design above, with automated tests covering access control and data exposure running as part of development.
Pre-Launch Hardening
Final infrastructure hardening, header and configuration checks, and readiness review ahead of Fall 2026 launch.
Launch & Ongoing Monitoring
Fall 2026 launch, with security monitoring active from day one and continued evaluation of third-party validation as the platform matures.
Common questions about permitOS security.
Is permitOS SOC 2 or ISO 27001 certified?
Not yet. permitOS does not currently hold any third-party security certification. We may pursue formal certification as the platform matures after launch, and we'll update this page if and when that happens.
Has permitOS been through a security audit or penetration test?
permitOS has completed a detailed internal architecture-level security review, but this was self-conducted, not an independent third-party audit or penetration test. We're not going to call it something it isn't.
Is my company's data visible to other permitOS customers?
No. permitOS is designed with tenant data isolation at the database level, so one customer's records are not visible to another.
Who inside my own company can see our permit data?
Access is designed to be controlled by role and by record, so you can scope what a given team member can view, create, or edit rather than giving every user full access by default.
Is data encrypted?
Connections to permitOS are designed to run over encrypted HTTPS, protecting data in transit between your browser and our servers. We'll share more detail on our broader encryption approach as we finalize infrastructure ahead of launch.
What happens if you detect suspicious activity on an account?
The platform is designed with security-event monitoring to flag unusual activity, such as repeated access denials or abnormal data access, for internal review.