Skip to main content

Security at Inqura

Inqura is built for compliance-critical investigative work, so the security model is part of the product, not an add-on. This page summarizes the controls that protect your evidence and analyses. For contract-level detail, see the legal documents for your deployment model.

Built-in controls (both deployment models)​

  • Encryption in transit and at rest. Traffic between you and Inqura is TLS 1.2+ (terminating at the CloudFront edge; internal hops between Inqura's own AWS components travel the private AWS network); stored evidence and databases are encrypted at rest with customer-managed KMS keys.
  • Role-based and row-level access control. Every request is authorized against the requesting user's organization and role — evidence and analyses are never readable across organization boundaries.
  • Signed-URL file access. Evidence files are served through short-lived signed URLs, never from publicly addressable storage.
  • Audit logging. State changes — uploads, edits, deletions, analysis runs — are recorded in an audit log, including failed attempts.
  • Evidence-bounded analysis. Findings cite the specific evidence behind each claim, so every conclusion can be traced and verified.

AI processing​

Analysis runs on AWS Bedrock inside the AWS boundary of the deployment. Evidence is sent to the model to produce an analysis and is not used to train models — AWS Bedrock does not retain or train on customer inputs and outputs.

Deployment models​

Hosted SaaS. Inqura operates the infrastructure in AWS. Your data stays within Inqura's AWS environment and is isolated per organization by the access controls above.

Licensed deployment. The software runs entirely inside your AWS account and region (commercial or GovCloud). Inqura operates no shared infrastructure that your data transits or rests in, and in normal operation has no access to your instance or your content. Customer-managed KMS keys (CMK) are supported, and you control all retention and deletion. The licensee legal documents describe this boundary in detail.

Shared responsibility​

Inqura ships secure defaults and the controls above. In a licensed deployment, the security configuration of the surrounding AWS account — IAM, network controls, key management, user authentication — is owned and administered by you, following the AWS Shared Responsibility Model.

Security questions​

Working through a security questionnaire or a procurement review? Contact us at security@inqura.ai and we will complete it with you directly.