Skip to content
Transynq

Security and trust

Trust you can check before we ever meet.

Transynq runs as a service on Microsoft Azure, in the Azure region nearest you. Everything below is drawn from how the platform is actually built and from Microsoft's published controls, laid out against the CAIQ domains so your security team can start with answers rather than questions.

Send us your CAIQ Read the controls

  • Your nearest Azure region

    Each customer deployment is its own pool, created from one infrastructure template in the Azure region nearest you. Database, storage and compute stay there.

    • Regions across Australia, the UK, Europe, North America and Asia
    • Backups can be kept in-region rather than geo-replicated
    • Microsoft will not move your data outside your chosen geography without your authorisation

  • Encrypted in transit and at rest

    TLS 1.2 or better on every connection with HSTS, and Azure's AES-256 encryption for databases, backups and files, on by default.

    • TLS 1.2 minimum, TLS 1.3 supported, FTPS disabled
    • AES-256 at rest for Azure SQL and storage, which cannot be switched off
    • Secrets held in Azure Key Vault and read by managed identity, never in source

  • Separated by design

    One database per pool, and inside it every query is scoped to your company in code, with automated tests that fail if anything bypasses that scope.

    • Global query filters on every company-scoped table
    • Cross-company writes are rejected before they reach the database
    • Files stored under your company's own path in private storage

Answered by domain

Every CAIQ domain, with what we do and what Azure does.

The Cloud Security Alliance's CAIQ v4 groups its questions into seventeen control domains. For each one, the first list is what is built into Transynq and the second is what the platform inherits from Microsoft Azure.

A&AAudit and assuranceWhat has been independently checked, and what we assess ourselves.

In Transynq

  • A written threat model and an architecture decision record for every significant design choice, kept with the code.
  • A repository hygiene test scans the whole tree for secrets on every build; the history has been scanned clean.
  • We complete the CAIQ v4.1 for you in writing on request. Transynq itself holds no third-party certification yet.

From Microsoft Azure

  • Microsoft Azure holds CSA STAR Certification (ISO/IEC 27001 with the Cloud Controls Matrix) and CSA STAR Attestation (SOC 2 Type 2 against CCM v4), listed on the CSA STAR Registry.
  • Regular independent audits for ISO/IEC 27001, SOC 1, SOC 2 and SOC 3, with reports and bridge letters on the Microsoft Service Trust Portal.
  • Australia: IRAP assessed up to and including PROTECTED across the Australian regions.
AISApplication and interface securityHow the web app, the API and the driver app defend themselves.

In Transynq

  • Default-deny authorisation: an API endpoint must opt in to be public.
  • A session-bound CSRF token on every state-changing request.
  • Strict security headers: a Content-Security-Policy of default-src 'none' on the API and frame-ancestors 'none' on the app, X-Frame-Options DENY, nosniff and no-referrer.
  • CORS allows exact HTTPS origins only; the service refuses to start with a wildcard.
  • Parameterised SQL throughout, with a test that blocks raw SQL outside an allow-list.
  • Per-IP rate limits, tighter on sign-in, public tracking and the photo gallery.
  • File imports limited by type and size; errors return a generic message with a correlation id, never a stack trace.
  • A versioned API under /api/v1 with a frozen OpenAPI contract checked in CI.

From Microsoft Azure

  • App Service supports TLS 1.3 with TLS 1.2 as the minimum, segregates each app from other tenants and patches the underlying VMs and runtimes.
BCRBusiness continuity and operational resilienceBackups, health checks and how a release reaches production.

In Transynq

  • Liveness and readiness health endpoints; readiness includes the database.
  • Releases deploy to a staging slot, pass a health check, then swap.
  • A restore point is recorded before every database migration.
  • Availability tests from three Azure regions every five minutes, with alerts on failures, server errors and slow responses.

From Microsoft Azure

  • Azure SQL automated backups: full weekly, differential every 12 to 24 hours, transaction log about every 10 minutes.
  • Point-in-time restore for 7 days by default, configurable up to 35; long-term retention up to 10 years.
  • Backup storage is geo-redundant by default, or kept within the region on request.
CCCChange control and configuration managementEvery change is reviewed, tested and released the same way.

In Transynq

  • All infrastructure is defined as code, one template per deployment, with resource locks in production.
  • Every change goes through CI: compiler warnings as errors, static analyzers, type checks and lint.
  • Database migrations are rehearsed against a clean database before release.
  • Pre-production first; production releases require an approval.
  • About 1,150 automated tests across unit, API, integration and parity suites, plus 127 front-end test files including accessibility checks.

From Microsoft Azure

  • Deployment slots on App Service and managed runtimes for Functions, patched by the platform.
CEKCryptography, encryption and key managementWhat is encrypted, with what, and where the keys live.

In Transynq

  • HTTPS only, TLS 1.2 minimum, HSTS and FTPS disabled on every app.
  • Storage accounts: HTTPS only, TLS 1.2 minimum, no public blob access and no shared-key access.
  • Secrets live in Azure Key Vault with purge protection and 30-day soft delete, read by managed identity. Nothing secret is in source.
  • The application's data-protection key ring is wrapped by a Key Vault key; integration credentials such as WhatsApp tokens are encrypted with it.

From Microsoft Azure

  • Azure SQL Database: Transparent Data Encryption with AES-256, on by default, covering the database, its backups and logs. Customer-managed keys are optional.
  • Azure Storage: 256-bit AES, FIPS 140-2 validated, enabled on every account and cannot be disabled.
  • Key Vault keys are protected by FIPS 140 validated hardware security modules.
  • App Service encrypts app settings and connection strings at rest.
DCSDatacentre securityWhere the servers are and who can walk up to them.

In Transynq

  • Each deployment is a separate pool in the Azure region nearest you, so compute, database and storage sit in that region.

From Microsoft Azure

  • More than 400 facilities with fenced perimeters, staffed entrances, two-factor access with biometrics, metal detection on the datacentre floor and cameras monitored at all times.
  • Every region sits inside a single geography that is a fixed data-residency boundary.
  • Retired drives are wiped to NIST 800-88 or physically destroyed.
DSPData security and privacyHow your data is kept apart from everyone else's, and what we collect.

In Transynq

  • One database per pool. Inside it, every query is scoped to your company by global filters, and cross-company writes are rejected.
  • Raw SQL runs only through a tenant-scoped helper that requires your company id; tests block anything else.
  • Files are stored under company-prefixed paths in private containers.
  • GPS stores only position and time, and only when your company turns tracking on.
  • Transynq AI reads curated views only, needs an explicit permission, can be switched off per company and keeps no audio.
  • Your data is yours to take: export any list to CSV or Excel.

From Microsoft Azure

  • Microsoft will not store or process customer data outside your chosen geography without your authorisation.
  • Microsoft acts as a data processor under its Data Protection Addendum and GDPR terms.
GRCGovernance, risk and complianceWho is responsible for what, and how decisions are made.

In Transynq

  • A documented go or no-go gate with named criteria before any production pool.
  • The threat model is reviewed as the design changes and tracks open risks to closure.
  • Shared responsibility: Microsoft runs the physical hosts, network and datacentres; Transynq runs the application, platform identities and configuration; you control your users and your data.

From Microsoft Azure

  • Compliance offerings include ISO/IEC 27001, 27017, 27018 and 27701, SOC 1, 2 and 3, PCI DSS, CSA STAR, Australia IRAP, UK Cyber Essentials Plus, EU GDPR, Germany C5 and Singapore MTCS.
HRSHuman resources securityHow people, ours and Microsoft's, get access.

In Transynq

  • Operational access uses Azure role-based access control and managed identities. There are no shared service passwords.

From Microsoft Azure

  • Datacentre staff pass background checks and training; physical access is approved per request and time-limited.
  • Microsoft engineers have no standing access to backups; any access is just-in-time.
IAMIdentity and access managementWho can sign in, what they can see, and how sessions are protected.

In Transynq

  • Six user kinds, platform admin, company admin, staff, customer, multi-customer and subcontractor, each limited to its own scope.
  • About 210 permission codes checked by the API on every call. Any administrator bypass is opt-in per endpoint and covered by audit tests.
  • Sessions are server-side and revocable: 12-hour maximum, idle timeout set per company, re-checked every 30 seconds.
  • The session cookie is a __Host- cookie, HttpOnly, Secure and SameSite=Strict. No token is exposed to JavaScript.
  • Lockout after 10 failed sign-ins in 10 minutes, plus a per-IP rate limit on sign-in.
  • Password reset links are single-use, expire within an hour, are stored hashed, never reveal whether an account exists and end all sessions.
  • Every sign-in attempt is audited with IP address and user agent, never the password.
  • Microsoft Entra ID sign-in is built in, with an issuer check and a server-side domain allow-list.

From Microsoft Azure

  • Azure role-based access control for platform operations, including Key Vault access by role.
IPYInteroperability and portabilityGetting data in and out, and avoiding lock-in.

In Transynq

  • Export any list to CSV or Excel.
  • API keys for system-to-system access, generated by Transynq and shown once.
  • FTP and SFTP exchange, and CSV import rules for customer systems.
  • Accounting exports for Xero by direct connection and MYOB, Reckon and SAP by file.
  • A versioned API with a frozen OpenAPI contract per version.

From Microsoft Azure

  • Standard Azure services throughout, so a deployment can be rebuilt from the same template in another region.
IVSInfrastructure and virtualisation securityThe platform underneath, and how it is locked down.

In Transynq

  • Azure App Service on Linux for the API and web app and Azure Functions for background jobs, one set per pool.
  • Managed identities instead of credentials between services.
  • No FTPS, no public storage and resource locks in production.

From Microsoft Azure

  • Azure DDoS infrastructure protection on every public endpoint at no extra cost.
  • Each app is segregated from other tenants; the platform patches VMs and runtimes continuously and defends against malware, DDoS and man-in-the-middle attacks.
  • Data-link layer encryption for Azure traffic within and between regions.
LOGLogging and monitoringWhat is recorded, for how long, and who is told.

In Transynq

  • Structured logs with a correlation id on every request, response and error.
  • Request bodies and credentials are never logged.
  • Application Insights and Log Analytics with 30-day retention.
  • A login audit, and history tables for jobs, legs, manifests, pricing, imports and permission changes.
  • Alerts on API errors, slow responses, failed background jobs and a missed job heartbeat.

From Microsoft Azure

  • Microsoft Defender for Cloud secure score and the Microsoft cloud security benchmark, included with the subscription.
SEFSecurity incident management and forensicsHow a problem is noticed, traced and communicated.

In Transynq

  • Every error carries a correlation id, so an incident can be traced across the API, background jobs and logs.
  • Alerts route to the operations team; availability is probed from three regions every five minutes.
  • The login audit and record histories support investigation after the fact.

From Microsoft Azure

  • Microsoft notifies customers of a breach of customer data without undue delay, under its Data Protection Addendum.
STASupply chain, transparency and accountabilityWho else is involved, and how we keep dependencies safe.

In Transynq

  • Outside services receive data only when you enable the integration that uses them; the full list is below.
  • Dependencies are pinned centrally and restored in locked mode; any package with a known vulnerability fails the build.

From Microsoft Azure

  • Microsoft publishes its own sub-processor list and announces new sub-processors at least six months in advance.
TVMThreat and vulnerability managementFinding weaknesses before someone else does.

In Transynq

  • Every build scans NuGet and npm dependencies for known vulnerabilities and fails on findings.
  • .NET analyzers at the latest recommended level, with warnings treated as errors.
  • A repository secret scan on every build.
  • Rate limits on sign-in, tracking and other public pages.

From Microsoft Azure

  • Platform-level threat management against malware, DDoS and man-in-the-middle attacks; Defender for Cloud available on the subscription.
UEMEndpoint managementDrivers' phones and the office browser.

In Transynq

  • Drivers sign in with a company code and PIN, or a QR code; a sign-in from a second device within 24 hours is refused.
  • Driver tokens are revoked on sign-out or the next sign-in.
  • Background location runs only when your company enables it and the driver grants permission in the operating system.
  • Crash reporting to catch faults in the field.
  • In the office, no session token is readable by browser scripts, and the app refuses to be framed by other sites.

Who else touches your data

Only the services you switch on.

Transynq's own data sits in Azure in your region. These outside services receive data only when you enable the integration that uses them.

Sub-processors and the data each receives when its integration is enabled
ServiceUsed for, when enabled
Microsoft AzureHosting for every deployment: compute, database, storage, secrets, logs and the GPS log. Always.
TwilioSMS notifications to customers and receivers.
SendGridEmail notifications, confirmations and reports.
Meta (WhatsApp Business)The WhatsApp channel for drivers.
Google Maps PlatformMaps, address lookup and distances.
Google FirebasePush notifications to the driver app and driver chat.
DropboxScheduled export of your grids to your own Dropbox account.
XeroAccounting sync, by direct connection.
OpenAI or AnthropicTransynq AI, only when it is enabled for your company.
SentryCrash reports from the driver app.

Check it yourself

Microsoft's own documentation.

The Azure facts on this page come from these pages, so you can read the source rather than take our word for it.

Keep reading

Related reading.

Send us the questionnaire. We will send it back answered.

CAIQ, your own vendor assessment or a list of questions from your IT team: we answer every line in writing, with pointers to the Azure audit reports on Microsoft's Service Trust Portal.

Book a demo View pricing