Innovexus is self-hosted software, so it does not hold SOC 2 or ISO 27001 attestations and it never processes your data — the environment's controls are part of your own program, on your own infrastructure. This page is the single source of truth for what the software provides, what it does not, and exactly where that line falls.
What the appliance contributes to your compliance program, the evidence it exports, and where the self-hosted boundary sits — stated plainly.
Self-hosted means Innovexus does not process your data. This page explains why there are no sub-processors for your operational data, and what you optionally control.
There is no vendor uptime SLA because you run the appliance. What that means, and how support and updates work.
Architecture summary, encryption, key custody, threat model. Detailed report and SOC 2-style evidence available on request under NDA.
80-question vendor-neutral evaluation template (CC BY 4.0). Includes Innovexus answers in Appendix B.
Pen-test summary, encryption architecture, threat model walkthrough, custom compliance attestations, regional data residency, BAA scope — all available under NDA via the trust mailbox.