Security, Continuity & Data Governance Center
End-to-end asymmetric payload encryption, live official-source RPA retrieval with zero proprietary citizen databases, in-memory CSV destruction, and transparent TPRM disclosures.
TPRM Questionnaire Quick-Reference
Direct answers for SIG Lite, CAIQ, and institutional vendor-risk reviews:
< 15 min failover · ≤ 4 hours full DR
Stateless workloads run across multi-AZ AWS Lambda & ECS Fargate with an active Amazon Aurora read replica for sub-15-minute instance failover, and ≤ 4 hours Recovery Time Objective for full regional restoration.
0 bytes PII · ≤ 5 min metadata PITR
Input CSVs are processed in memory and immediately destroyed (0 bytes of cleartext PII on disk). Encrypted batch output files reside in isolated AWS S3 (RSA-4096 ciphertext) for up to 72h prior to first download, with immediate purge on request or automatic deletion within max 1h post-download. Metadata RPO ≤ 5 min (PITR).
Internal: Nov 8, 2026 · External: Pending
Most recent internal security & dynamic API review executed on November 8, 2026 by AlphaTech's platform engineering team against OWASP API Security Top 10 (2023). AlphaTech has not yet commissioned an independent third-party penetration test.
Live RPA · Current Mexican Data Law
Live 1-to-1 RPA retrieval under Customer mandate (zero proprietary databases), 24-hour notice for any incident affecting personal data processed on behalf of the Customer, and direct security desk at [email protected] (2025 LFPDPPP).
Generate your key pair
RSA-4096 key pair generated in your environment. Your private key never leaves your servers.
Register public key
Upload only your public key in the AlphaTech portal with instant self-service rotation.
In-memory RPA & cipher
Live RPA output is encrypted in memory via ephemeral AES-256-GCM + RSA-4096-OAEP.
Exclusive decryption
Only your private key decrypts the JSON response—even AlphaTech cannot read cleartext payloads.
Technical Architecture Deep Dives
Traditional API Custody vs. Zero-Trust
Why delegating confidentiality to client-held asymmetric keys eliminates plaintext data-broker risk.
Hybrid Envelope: RSA-4096 + AES-256-GCM
Per-request ephemeral keys, RSA-PSS anti-replay signatures, and HMAC-SHA256 webhook verification.
Security & Compliance FAQ
Does AlphaTech hold a standalone SOC 2 report or ISO 27001 certification?
AlphaTech does not yet hold its own standalone SOC 2 report or ISO/IEC 27001 certification. Production infrastructure runs on AWS (us-east-1 and mx-central-1), while AlphaTech maintains a documented internal control framework informed by ISO/IEC 27001:2022 and SOC 2 security/confidentiality criteria, plus isolated Customer VPC or On-Premise deployment options.
What are your Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?
Instance/compute failover RTO is under 15 minutes (serverless AWS Lambda, ECS Fargate, and active Amazon Aurora read replica), and full platform disaster recovery RTO is ≤ 4 hours. Verification payloads and Batch CSVs carry 0 bytes of PII loss exposure because no cleartext PII is stored at rest; tenant metadata and credit balances maintain an RPO of ≤ 5 minutes via 7-day Point-in-Time Recovery (PITR).
When was your last penetration test performed and by whom?
Our most recent internal penetration test and dynamic API security assessment was completed on November 8, 2026 by AlphaTech's internal platform security engineering team against OWASP API Security Top 10 (2023). AlphaTech has not yet commissioned an external penetration test from an independent third-party firm.
Where do verification records come from and how are Batch CSV uploads destroyed?
AlphaTech holds zero static citizen databases. Every lookup runs live via Robotic Process Automation (RPA) against official Mexican portals under Customer mandate, aligned with Mexico's 2025 LFPDPPP (in force March 21, 2025, overseen by the Secretaría Anticorrupción y Buen Gobierno). Input CSV files are parsed in volatile memory and immediately destroyed. Encrypted Batch output files (ciphered to your RSA-4096 public key) are held in isolated AWS S3 for up to 72 hours prior to first download; once downloaded, you may trigger an immediate purge or the system deletes the encrypted file within at most 1 additional hour.
How does automated RPA retrieval align with Mexican government portal rules?
Most Mexican public registries do not publish commercial B2B APIs for private institutions. AlphaTech never bulk-scrapes, mirrors databases, or circumvents private security controls. Instead, connectors operate in two lawful modes: (1) individual 1-to-1 lookups against registries mandated by Mexican statute for public verification (CURP, INE Nominal Roll, SEP Licenses, SAT 69-B/CFDI verification, REPUVE, REPSE, public court bulletins) with polite rate-limiting; and (2) user-permissioned sessions where RPA acts solely as an ephemeral, in-memory technical agent explicitly authorized by the data subject and Customer (Responsable under the 2025 LFPDPPP), analogous to consumer-permissioned Open Finance. Questions from Legal/TPRM teams: [email protected].