Beta Cut Above CMS is in beta with its first customers. It works, it changes weekly, and when something breaks you talk to the person who built it. Tell us what you need. In beta with our first customers. Tell us what you need.
Trust

Security

How Cut Above is built and hosted, and which certifications we do not hold yet.

Architecture

  • Isolation in the database. Every row carries its workspace, and a policy the database enforces on every table (not the application) means a session can only ever read or write rows in its own workspace. Enterprise customers additionally get a separate database and deployment, in a region chosen for them.
  • Authorisation in the database. Every table carries row-level security. The application may add checks, but the database enforces them, so a bug in a screen cannot expose a record the viewer is not entitled to.
  • Access by invitation only. Signing in with Microsoft or Google does not grant access; an invitation from your administrator does.
  • Encrypted at rest and in transit. TLS everywhere; database and storage encrypted at rest by the hosting provider; connection tokens and mail server passwords are also encrypted with a key unique to each workspace.
  • Integrations with the least access needed. Microsoft and Google connections are delegated: each person authorises their own account, and the system can reach only what they can. There are no application permissions across a whole tenant.
  • Audit log. Every write, by whom, when, including actions the assistant performed on someone's behalf.

What we do not claim

  • Cut Above holds no security certification (no ISO 27001, no SOC 2). Our hosting providers hold theirs; we can share them.
  • There has been no independent penetration test yet. One is planned before the first regulated customer.

Reporting a vulnerability

Write to security@cutabove.ai. We acknowledge within two working days and do not pursue researchers acting in good faith.