Trust

Security built for public documents.

Remediate is designed for publicly published records, with a private review workspace before anything goes live.

Tenant isolation

Every document, ticket and usage event is scoped to a workspace. Access is checked on every request.

Uploads start as drafts. The viewer URL is gated until a document is deliberately published.

TLS is required in production; cookies are HttpOnly, SameSite and Secure. Sessions are revocable.

Owner, admin and member roles. Platform administration is separate from customer workspaces.

Uploads, publishes, plan changes, team changes and support actions write to an audit log.

The viewer is keyboard operable with semantic tables, landmarks and announcements. We publish a VPAT/ACR after the accessibility audit closes.

Email [email protected]. We acknowledge security reports within one business day.

This page describes the current build. A formal security package, DPA and subprocessor list are available on request.