# DecisionManager — Security & Hosting Pack

**Audience:** security, compliance, procurement, and IT reviewers  
**Purpose:** one attachable brief for questionnaires and vendor reviews  
**Source of truth:** https://decisionmanager.io/security (or your deployment’s marketing site `/security`)  
**Updated:** 2026-08

> Nothing in this pack is aspirational. Where we do not hold a certification or guarantee, we say so.

---

## 1. Product in one paragraph

DecisionManager is a business rules / decision automation platform: author, govern, deploy, and execute decision tables, action rules, and ruleflows without redeploying application code. Surfaces include Decision Manager (authoring), Decision Server (runtime operations), Admin (people, keys, audit), and a VS Code / Studio path for developers.

---

## 2. What we do **not** claim

| Topic | Honest position |
| --- | --- |
| SOC 2 / ISO 27001 / HIPAA (etc.) | **No formal certification today.** Operational practices are described as SOC 2-**aligned**. Alignment is not certification; we will not present it as one. Formal certification is on the roadmap. |
| Automated ODM migration | AI-assisted translation is real; **every** migrated artifact is reviewed by a person before publish. No one-click / 100% automated migration promise. |
| Uptime without a written SLA | Hosted self-serve is **as-is** unless the plan includes a written SLA. **Enterprise includes an SLA.** |
| Customer logos / fake social proof | No logos or testimonials without written customer permission. |
| Multi-region hosted SaaS mesh | Hosted is **EU** (Frankfurt default). Own-cloud and edge run under **your** account/regions — not a DecisionManager multi-region mesh. |

---

## 3. Deployment shapes (data control)

Same product images and features across shapes. Pick the row your regulator will accept.

| Option | Data location | Operated by | Available on |
| --- | --- | --- | --- |
| Hosted (EU) | EU regions, Frankfurt by default | DecisionManager | All plans |
| Your cloud account (AWS / Azure / GCP) | Any region you choose; no provider-specific product code | You | Business, Enterprise |
| On-premise / air-gapped | Your datacenter | You; no outbound network required | Enterprise |
| Signed edge decision bundle | Inside your boundary (e.g. Lambda, Workers, Cloud Run under your account) | You / artifact | Complements control plane |

**Edge note:** a hash-verified decision bundle (.dmb) can run with **no database** and **no outbound network**, so the decision itself can execute inside a boundary the control plane never crosses. Integrity is content_hash; cryptographic signing is residual.

---

## 4. Controls you can exercise

1. **Data residency & tenancy** — choose hosted EU, own-cloud region, or on-prem/air-gap; workspace-level isolation.  
2. **Access** — least-privilege RBAC; hashed, workspace-scoped API keys; short-lived JWTs; Argon2id password hashing.  
3. **Change control** — draft → review → approved → published governance with separation of duties on higher tiers.  
4. **Evidence** — full audit trail of platform activity for “who changed this, and when.”  
5. **Privacy / GDPR orientation** — data minimization posture; export/erasure-friendly data model; **DPA available on Starter and above**.  
6. **Execution boundary** — edge/wasm portable runtimes and air-gapped Enterprise for decisions that must not leave your network.

---

## 5. Security practices (as operated / described)

- Argon2id password hashing  
- Short-lived JWTs  
- Hashed API keys (not stored in the clear)  
- Least-privilege role-based access control  
- Workspace isolation  
- Immutable-style audit logging of platform activity  
- Content-hash provenance on definitions/bundles (sha256 on edge path)  

These are **product and operational controls**, not a substitute for a third-party attestation report.

---

## 6. Documents & legal

| Document | Where |
| --- | --- |
| Security & hosting (live page) | `/security` |
| Privacy policy | `/legal/privacy` |
| Terms of service | `/legal/terms` |
| DPA | Available on **Pro** and **Enterprise** — request via contact |

---

## 7. How to continue a review

| Need | Path |
| --- | --- |
| Download this pack again | `/downloads/decisionmanager-security-pack.md` |
| Security / procurement questions, DPA, SLA, questionnaire | `/contact` — reply within one business day · demo@decisionmanager.io |
| See the product without a call | `/demo` (browser sandbox) |
| Trial workspace | `/signup` |
| Docs & API (no email wall) | `/docs` |

**Suggested email subject for security review:**  
`Security questionnaire — DecisionManager — [Your company]`

---

## 8. FAQ (short)

**Q: Do you hold SOC 2 or ISO 27001?**  
A: No. Practices are SOC 2-aligned; alignment is not certification.

**Q: Can data stay in the EU on hosted plans?**  
A: Yes. Hosted plans run in EU regions with Frankfurt as the default. Rule definitions, executions, and warehouse data stay in the region you choose on hosted plans.

**Q: Can we run fully on our infrastructure?**  
A: Yes — own cloud (Business/Enterprise) or on-prem/air-gapped (Enterprise), same images and features.

**Q: Is there an uptime SLA?**  
A: Only when your plan includes a written SLA (Enterprise). Self-serve hosted is as-is.

---

*End of pack. If a questionnaire asks for a control we do not document here, say so on the call — we would rather fill a gap honestly than invent a checkbox.*