Security at Steppe

A compliance platform holds some of the most sensitive information a company has: its gaps, its risks and the evidence behind its controls. This page describes how we protect it. We hold ourselves to the same rules we help our customers follow.

Hosting and data location

  • Steppe runs on Amazon Web Services in Mumbai, India (ap-south-1).
  • All traffic is encrypted in transit with TLS.
  • Customers who need their data separated at the infrastructure level can take a dedicated instance with its own server and database.
  • The database is backed up every night. Backups are verified and copied to separate storage that the application server can write to but cannot read, list or delete.

Access control

  • Access is invite only. There is no public signup, and every account belongs to a named person.
  • Passwords must be at least 12 characters and are checked against known breached passwords, in line with NIST SP 800-63B. We do not force pointless rotation.
  • Invite links are single use and stored only as hashes.
  • Permissions are checked on every request, by role and by ownership of the record.
  • Nobody can change their own access level, and only an owner can make another user an owner.
  • Auditors get read only access with a fixed end date.

How our team accesses your workspace

When VASUIST staff support a customer, they enter that workspace through an attributed session with a stated reason and a time limit. Every action they take is written to the customer's own audit log. We never hold customer passwords.

Integrity and accountability

  • Every change is recorded in a plain English audit log.
  • Separation of duties is enforced: the owner of a control or document cannot approve it unless a time limited exception has been recorded with a reason and an independent reviewer.
  • Records an auditor may need are kept, not deleted. Completed and closed items leave the working views but stay available.
  • Steppe drafts documents for people to approve. It never generates evidence.

Application security

  • Files are stored per customer, with every path validated so one customer can never reach another's files.
  • A strict content security policy limits what the browser will load and run.
  • Staff login is rate limited.
  • Tokens for connected systems are stored encrypted, and integrations request read only access. The scopes recorded are the ones actually granted.
  • The service is monitored around the clock for availability, disk, memory, backups and certificate health.

AI features

Some Steppe features use Anthropic's Claude models to read documents or draft text for a person to approve. AI output is always marked as a draft and never published or used as evidence on its own. File names are not sent to the model. For customers with strict data requirements, AI features stay off unless the customer approves them in writing, and Anthropic is then listed as a sub processor.

Certification

We plan to certify Steppe against ISO 27001 and then SOC 2, and we track our own program in Steppe, the same way our customers do.

Reporting a vulnerability

If you believe you have found a security issue in steppe.in or the Steppe platform, email outpost@steppe.in with the details and steps to reproduce it. Please do not access data that is not yours, disrupt the service or share the issue publicly before we have fixed it. We will acknowledge your report and keep you updated until it is resolved.