Security

Organisations rely on ChangeGate for records that stand up as evidence, so protecting their data is built into how the product works and how we run it. This page gives an overview of the measures in place.

Each organisation’s data kept separate

Every customer has its own workspace. The separation between workspaces is enforced in the database itself, not only in the application, so that each organisation sees only its own records.

Access based on role

What each person can see and do is set by the role their organisation gives them. Actions such as approving a change are limited to the people entitled to take them, and the person who proposes a change cannot approve it.

A tamper-evident record

Every action on a change is written to an audit trail that cannot be edited or deleted. Entries are linked in sequence, so an attempt to alter the history can be detected.

Encryption

Data is encrypted in transit between your browser and our services, and encrypted at rest by our hosting providers.

Accounts and sign-in

Passwords are never stored in readable form. Each organisation decides who has an account in its workspace and can remove access at any time.

How we build and run the platform

Changes to the platform are reviewed and tested before they are released, and we monitor the platform for errors so that problems are found and fixed quickly. Access to customer data within our team is limited to the people who need it to provide and support the service.

Reporting a security issue

If you believe you have found a security vulnerability, please email security@changegate.io with the details. Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly. We appreciate reports made responsibly.

Security reviews

If your organisation is evaluating ChangeGate and needs more detail for a security review or questionnaire, contact us at security@changegate.io and we will be happy to help.

Solutions

Professional services