You're being asked to store your most sensitive security evidence in this workspace, so it's fair to ask how it's protected. intSignal is targeted by attackers globally, and the workspace was built to a hostile threat model with defense-in-depth. Here's exactly how.
One account, a separate system underneath
You experience the workspace as part of the portal — one login, one UI. Underneath, it is a separately isolated system. The rest of the portal cannot read the workspace's data directly, and the workspace cannot read the portal's operational data directly. They meet only at your identity.
The six hard boundaries
- Service / API isolation — the workspace is its own service behind a hard API boundary with its own authentication and authorization and its own service identity.
- Data isolation — a dedicated database with its own least-privilege credentials, network-restricted, no shared tables with portal customer or ops data. Per-tenant row isolation is enforced in the service layer, deny-by-default — not by convention.
- Object-storage isolation — evidence files live in a dedicated private bucket with its own credentials. No public objects; access only via short-lived signed URLs; files are never executed.
- Key isolation — evidence and sensitive fields are encrypted with keys distinct from the portal's (envelope encryption, per-tenant data keys), with rotation supported.
- Audit isolation — a separate, append-only, tamper-evident audit log records every evidence read, write, delete, export, and admin action — with actor, tenant, time, and IP.
- Admin isolation — least-privilege RBAC and a separate admin plane. A portal or global admin has no implicit access to your evidence; break-glass access is itself audited.
What this means for you
- Even we can't casually see your files. Access to tenant evidence isn't a side effect of being an intSignal admin — it's gated, least-privilege, and logged.
- Tenant A can never reach tenant B. Isolation is proven with automated tests covering IDs, exports, storage URLs, and the audit log — not just assumed.
- Everything is encrypted in transit and at rest, with signed, expiring access to files.
- Uploads are hardened — type and size allow-lists, content sniffing, and malware scanning.
Your controls
- MFA/TOTP — enable it; it's the biggest protection against a stolen password. See Account, data & MFA.
- Export & delete — you can export everything and delete your data and account at any time.
- Least privilege on your side — assign access to the people who need it and no more.
If your own security review needs deeper detail than this page, contact us and we'll walk your team through the architecture.