Access and identity
How we control who can access MetricsLM.
- Email-confirmed authentication
- Role-based access (owner, editor, viewer)
- Enterprise SSO, MFA and SCIM In progress
Our Commitment
Security & Trust
We're building MetricsLM with enterprise-grade security, privacy and compliance, so you can use AI with confidence.
Security posture
Security by design
Controls built into the platform.
Data protection
Organisation-scoped access and isolation.
Compliance
SOC 2, ISO 27001 and GDPR in progress.
Enterprise ready
Built for regulated and high-stakes use.
Our approach
Practical, evidence-led security for enterprise AI assurance.
Data and isolation
How we keep your data separate and protected.
- Organisation as the tenant
- Row-level security (RLS) for data access
- Repository-scoped, read-only GitHub access
AI processing
How we use AI to analyse your systems.
- Structured, minimal data sent to a configured AI gateway
- Results stored in MetricsLM for assurance and traceability
- Provider retention and processing terms under review
Evidence and assurance
How we create a clear, reviewable record.
- Cited evidence from your repositories
- Human approval of purpose, boundary and reassessment
- Change history and decision record
Compliance programme
We're building a formal security and privacy programme, with a clear path to independent assurance.
SOC 2 Type II
Readiness programme underway, including control assessment and remediation.
In progress
ISO/IEC 27001:2022
Assessing controls and evidencing an Information Security Management System (ISMS).
In progress
UK & EU GDPR
Reviewing our data practices, retention, access controls and privacy processes.
In progress
Frequently asked questions
Quick answers to common security and compliance questions.
- Is MetricsLM SOC 2 or ISO 27001 certified?
- Not yet. We've begun our SOC 2 Type II and ISO 27001 programmes and are working towards independent assurance.
- How do you protect our data?
- Access is restricted by authentication, role-based permissions and organisation-level isolation. We're also strengthening our retention, deletion and audit capabilities.
- Do you offer SSO or MFA?
- Enterprise SSO, multi-factor authentication (MFA) and SCIM user provisioning are in progress.
- What happens to our data in AI processing?
- We send structured, minimal data to a configured AI gateway and store the results in MetricsLM. Provider retention and processing terms are under review.
- Can we delete our data?
- Self-service deletion is not yet available. You can request deletion or export by contacting our team.
- Where is our data hosted?
- We currently use managed cloud infrastructure. Full hosting and subprocessor details will be published as part of our compliance programme.
Have a security or compliance question?
Speak with our team about your requirements.
security@metricslm.ai