Security, Continuity & Data Governance Center
End-to-end asymmetric payload encryption, live official-source RPA retrieval with zero proprietary citizen databases, in-memory CSV destruction, and transparent TPRM disclosures.
TPRM Questionnaire Quick-Reference
Direct answers for SIG Lite, CAIQ, and institutional vendor-risk reviews:
< 15 min failover · ≤ 4 hours full DR
Stateless workloads run across multi-AZ AWS Lambda & ECS Fargate with an active Amazon Aurora read replica for sub-15-minute instance failover, and ≤ 4 hours Recovery Time Objective for full regional restoration.
0 bytes PII · ≤ 5 min metadata PITR
Because API payloads and Batch CSV files are processed in volatile memory and immediately destroyed, 0 bytes of cleartext PII are stored or at risk. Tenant metadata and credit balances use 7-day Point-in-Time Recovery (RPO ≤ 5 min) on encrypted Amazon Aurora / RDS.
Internal: Nov 8, 2026 · External: Pending
Most recent internal security & dynamic API review executed on November 8, 2026 by AlphaTech's platform engineering team against OWASP API Security Top 10 (2023). AlphaTech has not yet commissioned an independent third-party penetration test.
Live RPA · Current Mexican Data Law
Zero static citizen databases: queries execute live via RPA against official portals under Customer mandate, governed by Mexico's 2025 LFPDPPP (in force March 21, 2025, repealing the 2010 Act) overseen by the Secretaría Anticorrupción y Buen Gobierno.
Generate your key pair
RSA-4096 key pair generated in your environment. Your private key never leaves your servers.
Register public key
Upload only your public key in the AlphaTech portal with instant self-service rotation.
In-memory RPA & cipher
Live RPA output is encrypted in memory via ephemeral AES-256-GCM + RSA-4096-OAEP.
Exclusive decryption
Only your private key decrypts the JSON response—even AlphaTech cannot read cleartext payloads.
Technical Architecture Deep Dives
Traditional API Custody vs. Zero-Trust
Why delegating confidentiality to client-held asymmetric keys eliminates plaintext data-broker risk.
Hybrid Envelope: RSA-4096 + AES-256-GCM
Per-request ephemeral keys, RSA-PSS anti-replay signatures, and HMAC-SHA256 webhook verification.
Security & Compliance FAQ
Does AlphaTech hold a standalone SOC 2 report or ISO 27001 certification?
AlphaTech does not yet hold its own standalone SOC 2 report or ISO/IEC 27001 certification. Production infrastructure runs on AWS (us-east-1 and mx-central-1), while AlphaTech maintains a documented internal control framework informed by ISO/IEC 27001:2022 and SOC 2 security/confidentiality criteria, plus isolated Customer VPC or On-Premise deployment options.
What are your Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?
Instance/compute failover RTO is under 15 minutes (serverless AWS Lambda, ECS Fargate, and active Amazon Aurora read replica), and full platform disaster recovery RTO is ≤ 4 hours. Verification payloads and Batch CSVs carry 0 bytes of PII loss exposure because no cleartext PII is stored at rest; tenant metadata and credit balances maintain an RPO of ≤ 5 minutes via 7-day Point-in-Time Recovery (PITR).
When was your last penetration test performed and by whom?
Our most recent internal penetration test and dynamic API security assessment was completed on November 8, 2026 by AlphaTech's internal platform security engineering team against OWASP API Security Top 10 (2023). AlphaTech has not yet commissioned an external penetration test from an independent third-party firm.
Where do verification records come from and how are Batch CSV uploads destroyed?
AlphaTech holds zero static citizen databases. Every lookup runs live via Robotic Process Automation (RPA) against official Mexican portals under Customer mandate, aligned with Mexico's 2025 LFPDPPP (in force March 21, 2025, overseen by the Secretaría Anticorrupción y Buen Gobierno). Batch CSV files are parsed and processed entirely in volatile memory and immediately destroyed.