Protecting your data is a priority at DataOwn. We work on security in two complementary ways: building secure processes as we work towards ISO 27001 certification, and testing how well our technical safeguards hold up in practice.
Preparing for ISO 27001 certification
We are currently carrying out an internal audit in preparation for the external certification audit. DataOwn is not yet ISO 27001 certified.
The work goes beyond writing policies. It means putting clear procedures in place, following them consistently and documenting how we do so. Security and data minimisation need to be part of our daily work, from the decisions we make to the way we manage customer data.
Testing the platform in practice
A few weeks ago, we completed a penetration test with security expert Max. He assessed whether he could gain unauthorised access to our systems or access one customer's data from another customer's environment.
The assessment included access to the source code and covered authentication, tenant isolation, authorisation, and SQL and dbt workflows. In other words, it examined both how users gain access and whether the boundaries between customer environments hold up.
The test did not identify a direct compromise, but it did uncover several weaknesses. For example, some identifiers were exposed that could help an attacker investigate other vulnerabilities. Those findings gave us concrete opportunities to strengthen the platform.
Fixing findings and checking the results
DataOwn's team has addressed more than ten high-priority security findings. Retesting confirmed substantial improvements to tenant separation, credential protection, internal service exposure, brute-force protection, and the security of Lightdash and dbt functionality.
These changes reduce DataOwn's attack surface and strengthen the safeguards around customer data. They do not make security a finished task: we continue to assess risks and improve our defences. The next penetration test is already being planned.
ISO 27001 preparation and penetration testing reinforce each other. Clear processes help us work securely every day, while practical testing helps us identify and address weaknesses in the platform. Both are part of our ongoing responsibility to protect your data.