Security & trust overview

Auth, multi-tenant isolation, Accept gates, honest boundaries.

IMP — Security & trust overview

Product: Impact Management Platform (Altamont Digital) Audience: IT security, risk, and procurement reviewers Status: Product overview for RFP / pilot diligence (not a formal ISO certificate)

1. What IMP is

A multi-tenant SaaS workspace for delivery, MERL, evaluation, and finance (EMS). Organisations work in isolated tenants. Humans remain in control of what is treated as final (Accept gates).

2. Identity & access

Control	Practice
Authentication	Clerk-hosted sign-in / sign-up (enterprise SSO options via Clerk plan)
Authorisation	Organisation membership + roles (Admin / Staff / Viewer)
Invites	Email invite → join the inviting organisation workspace
Session	Managed by Clerk; the app never stores passwords
Least privilege	Viewers read; Staff write day-to-day data; Admins / Evaluation Leads Accept packages and manage team

3. Multi-tenant isolation

Every business record is scoped by organisation.
Server actions resolve the active organisation from the signed-in session (not from a client-supplied org id alone).
Cross-tenant reads and writes are rejected at the action layer.

4. Data protection posture

Topic	Summary
Transport	HTTPS in production
Application data	PostgreSQL (managed), application-layer org isolation
Files	Org-scoped object storage where attachments are used
Secrets	Environment / platform secrets. Kobo API tokens encrypted at rest, Admin-only
Backups	Hosting provider backup policy (Vercel + managed database)
Logging	Application audit log for sensitive actions (proposals, Accept, imports, Kobo pull)

5. AI / automation governance

AI drafts design, briefs, findings, IRB working dossiers, and specialist reviews.
Humans Accept design, packages, IRB sections, and specialist briefs before they are treated as team-approved.
Consent is never bulk-granted by agents.
Finance specialists never auto-approve payments.
Ethics holds block client-facing Accept until a human clears the site.

6. Survey / Kobo

Optional org connection: Kobo host + token. Pull-only. No write-back.
Mapping and preview are human-checked before pull.
CSV import remains available without a token.

7. What we do not claim

Not a certified medical device or clinical system of record.
Not a substitute for national HMIS offline enumeration at population scale.
Not a committee portal: IMP drafts an IRB working dossier; the institution files.
Formal pen-test / ISO 27001 certificates: share current status on request for enterprise pilots.

8. Buyer checklist (copy into the RFP)

[ ] Confirm SSO / IdP requirements with Altamont Digital
[ ] Confirm data residency preferences
[ ] Review DPA summary + execute DPA with counsel
[ ] Identify Admin users and Accept authority
[ ] If using Kobo: issue a project-scoped token; do not share personal passwords
[ ] Pilot success criteria (see 90-day pilot pack)

9. Contact

Altamont Digital / Altamont Group — altamontgroup.ca Institutional packages: imp-acquisition packages

Document version: 2026-08 · For procurement diligence