Infrastructure Layer
Provider
Key Certifications & Controls
- Multi-AZ redundancy
- DDoS protection
- Encrypted storage (RDS & S3)
- Continuous monitoring
Application Platform Layer
Provider
Key Certifications & Controls
-png.png?width=80&height=80&name=soc2%20(4)-png.png)
- Annual third-party audits
- Continuous ISMS monitoring
AI Layer (Optional)
Provider
Key Certifications & Controls
- GDPR-compliant data handling
- No model training on PSOhub data
- Customers must sign the OpenAI Data Use Agreement before activation.
Application & Data Management
Provider
Key Certifications & Controls
- Role-based access control
- Data encryption
- Incident response plan
- GDPR/ Data Act-compliant data export & deletion procedures.
AWS
AWS secures the physical data centers, networking, and storage infrastructure (“security of the cloud”).
Mendix
Mendix secures the application platform, including authentication, encryption, and runtime management
PSOhub
PSOhub secures how the software is built, configured, and operated (“security in the cloud”).
OpenAI
OpenAI provides secure AI services via API. PSOhub ensures no personal data is sent unless explicitly approved by the customer.
Encryption in transit
All data between users and PSOhub runs through HTTPS/TLS 1.2+ (end-to-end encrypted).
Encryption at rest
All application and file data stored in AWS RDS and S3 is AES-256 encrypted by default.
Optional end-to-end encryption modules
Mendix offers additional AES encryption modules for sensitive data sets.
Access control
Fine-grained role-based permissions down to entity and field level.
Defense in depth
Multi-layer security model combining infrastructure, application, and governance controls.
Responsible AI
(OpenAI Integration)
(OpenAI Integration)
Some PSOhub features use OpenAI technology to improve productivity and insight.
- Activation requires explicit customer consent via a separate OpenAI Data Use Agreement.
- No customer data is used to train OpenAI models.
- Data is processed securely under GDPR and SOC 2 controls.
- Customers can disable or delete AI-related data at any time.
We integrate AI responsibly — always transparent, optional, and privacy-first.
Annual third-party audits
Mendix and AWS undergo yearly SOC 1/2, ISO, and PCI DSS assessments.
24/7 platform monitoring
Automated detection of vulnerabilities and anomalies.
Security incident management
Documented process to notify affected customers within 24 hours.
Penetration testing
Regular external and internal tests to identify and resolve vulnerabilities.
ISO 27001 readiness (PSOhub)
Internal security roadmap towards certification in 2026.
Data Residency & Sovereignty
- Data is hosted in EU-based AWS data centers.
- Mendix and AWS follow strict data-location guarantees — data is never moved outside the selected region without explicit consent.
AWS
Infrastructure & storage provider (Dublin/ Frankfurt).
Mendix
Application platform provider (Netherlands).
OpenAI
AI provider (via API, optional).