Security & trust
DrillProof asks for access to the systems you care most about. This page is the detail your security reviewer will want, without the hedging.
Your data stays in your account
On bring-your-own-cloud — the default and recommended tier — DrillProof is only a control plane. Snapshots, restore points, and the temporary environments created during a drill all live in your AWS account, so there is no second place for your data to leak from. The hosted tier is the deliberate exception: there, you are asking us to store the backups.
Least-privilege cross-account role
Access is a role you create, with a trust policy naming DrillProof and an external ID unique to your tenant — the standard mitigation for the confused-deputy problem. No IAM user, no long-lived access keys, and no permissions beyond snapshot, restore, and cleanup.
Revoke at any time
Because access is only that role, removing it ends our access immediately and completely. There is no separate offboarding process, and your restore points remain in your account, restorable with standard AWS tooling.
Immutable by default
Restore points are written under S3 Object Lock in compliance mode, which enforces write-once-read-many retention at the storage layer. A compromised credential — including a root credential — cannot shorten retention or delete a locked object before it expires.
Encryption with your keys
Data is encrypted at rest with AWS KMS keys that you own, and in transit with TLS. You can rotate or disable a key without asking us, and key policy remains a control you hold rather than one you delegate.
Region pinning and residency
You pin the regions restore points may be written to, and DrillProof will not move data across that boundary. For a second-region standby, you choose the region explicitly.
What the control plane stores
Metadata about your backups, never their contents. Stated as two lists so there is nothing to infer.
Applies to bring-your-own-cloud. On the hosted tier you are explicitly asking DrillProof to store backup data, so the second list below does not apply to backup contents. If the boundary matters to your review, choose BYOC — see how the two tiers differ.
Stored
- Resource identifiers and types (for example: a cluster name, a volume ID)
- Backup and drill schedules, and retention policy
- Drill outcomes — what was restored, which assertions passed, observed timings
- Evidence records and their retention period
- Account and billing details for your organisation
Never stored
- Snapshot, volume, or filesystem contents
- Database rows, dumps, or query results
- Kubernetes Secrets, ConfigMap values, or application configuration
- Your KMS key material
- Long-lived AWS credentials of any kind
The boundary, drawn
Instructions cross into your account. Results cross back. Backup data never does.
DrillProof control plane
Schedules, policies, and drill results. Metadata only.
- backup + drill schedules
- retention & tiering policy
- drill outcomes, timings
- evidence records
No snapshots, volumes, or database contents are stored here.
AssumeRole
+ external ID
drill result
+ metadata
Your AWS account
Every byte and every restore stays here, in your region.
Workloads
EKS · EBS · RDS
Backup vault
S3 Object Lock
Drill sandbox
created, verified, destroyed
The drill sandbox is dashed because it is temporary: DrillProof creates it to prove the restore, then destroys it.
Compliance posture
Where we actually are, rather than where we would like to sound.
SOC 2 Type II
in progressWe are working toward SOC 2 Type II and are not certified today. We will not claim otherwise, and we are happy to share our current controls and timeline under NDA.
Evidence for your own audits
Drill records are exportable and dated, which is usually what an auditor asking about disaster recovery actually wants — proof that recovery was tested, not a policy document saying it should be.
Reporting a vulnerability
Email security@drillproof.com. We will acknowledge within one business day. We do not currently run a paid bounty programme and will say so up front rather than leaving you guessing.
Have your reviewer send questions
We would rather answer a security questionnaire early than discover a blocker late.