Innovexus is self-hosted software, so it does not hold SOC 2 or ISO 27001 attestations and it never processes your data — the environment's controls are part of your own program, on your own infrastructure. This page is the single source of truth for what the software provides, what it does not, and exactly where that line falls.
What the appliance contributes to your compliance program, the evidence it exports, and where the self-hosted boundary sits — stated plainly.
Self-hosted means Innovexus does not process your data. This page explains why there are no sub-processors for your operational data, and what you optionally control.
There is no vendor uptime SLA because you run the appliance. What that means, and how support and updates work.
Encryption, key custody, session brokering, outbound connections, threat model — the complete description, public.
80-question vendor-neutral evaluation template (CC BY 4.0). Includes Innovexus answers in Appendix B.
Everything we publish about security and compliance is on these pages. If an evaluation needs an answer that is not here, email [email protected] and we will answer it directly.