Security and governance
Control should be part of the architecture.
Tomstok’s security architecture connects your own cloud, bounded access, traceability and controlled change.
A concrete security foundation for your IT team
Protect the product knowledge your business depends on. Tomstok combines separate operational environments, least privilege and clear control over changes to products, prices and production information.
Your IT team gets a concrete architecture to review: account boundaries, access routes, data flows and approvals. Before adoption, we review the controls in your installation and clarify responsibility for ongoing operations.
Separate product data from operational access
Keep control of product data in your own AWS account. Central administration manages the installation through scoped access, while business data has a separate foundation and its own lifecycle.
An encryption key you manage and encrypted transport protect stored data and transfers. Key management, backup and access are reviewed with your IT team to align security with your operational responsibilities.
Read about your own cloud- Your AWS environment
Product data, configuration, calculations and local history.
- Central administration
Installations and versions through bounded permissions.
- AI in your account
Amazon Bedrock. Direct inference in Ireland as the EU default.
Architecture principle: Central administration is outside ordinary product calculation.
Grant access to the task, not everything
Give employees access to the tasks they handle. Reading, changing and deleting have separate permissions, while sensitive actions have their own approvals. Login identifies a person; your permissions determine what they can do.
You approve Tomstok support access, set an end date and can stop it locally. Get the help you need while retaining control of your data.
Explore access and permissionsKeep the connection between change and responsibility
Trace an order back to its product data, calculations and the changes behind it. Version references and action history give you a shared basis for explaining the result and understanding responsibility.
The activity history from your environment stays in your own cloud. Central administration receives bounded technical signals and metadata without business content. Sensitive credentials stay out of the history.
Explore traceabilityAI with bounded data processing
Use AI with the same control over data and permissions as the rest of your work. Tomstok uses Amazon Bedrock in your AWS account, with direct inference in Ireland as the default for businesses in the EU. The assistant works with necessary information and follows the user’s access and approvals.
An optional EU profile can extend processing to its EU regions and allow AWS retention for abuse detection. You approve that option separately and review the distinction between AI-service retention, your own logging and action history.
Review the controls against your requirements
Make the decision with a clear picture of operations and responsibilities. We review account boundaries, roles, data flows, updates and recovery arrangements with your IT team, clarifying the work owned by you, Tomstok and AWS.
The review uses documentation and concrete controls for your installation. Tomstok does not hold an achieved security certification; any certification requirements are therefore addressed separately during evaluation.
See Tomstok with your products in mind.
Talk to us about your product range and production requirements.