Read-only architecture. EU residency. Immutable evidence.
Six structural commitments. Each is enforced at the architecture layer, not the policy layer. Misconfiguration cannot violate them. Security is not a feature of this product; it is the product's reason to exist.
Read-only by design
Inform, Don't Act. The platform reads Azure metadata via Resource Graph and never holds write permissions on customer subscriptions. There is no write path, no policy push, no resource modification, and no code path that could be enabled to add one.
Tenant isolation
Row-level security at the database layer. Every query is scoped by a tenant identifier extracted from the request token, never the request body. No cross-tenant data path is architecturally possible under any failure mode.
Network
Azure Front Door fronts every public surface, with WAF (Web Application Firewall) running OWASP CRS 3.2 and BotManager 1.0 in Prevention mode on production. Backend services sit behind private endpoints; no SQL or storage account is reachable from the public internet.
Data residency
All data is processed and stored exclusively within Azure North Europe (Ireland) and West Europe (Netherlands). The legal entity is Irish-incorporated and Irish-law governed. No data leaves the EU under any flow.
Evidence immutability
Compliance evaluation records are write-once at the database layer. Historical state is permanent. Never updated, never deleted. Tamper-evident audit trail with seven-year retention.
Identity
Authentication runs on Microsoft Entra External ID (CIAM). Customer Azure subscription onboarding uses the multi-tenant admin-consent flow with Managed Identity. No long-lived credentials are stored anywhere on the platform.
Responsible disclosure.
If you believe you have found a security issue in Equalis OpsReg, contact contact@equalistech.com with the details. We acknowledge reports within one business day and will keep you informed through to resolution. Please do not access data that is not yours or degrade the service while investigating.