Security overview

Because SteadyState runs entirely on Microsoft Dataverse in your tenant, the infrastructure-level compliance posture is Microsoft's – the certifications that apply to your Dataverse environment (Microsoft's SOC, ISO, FedRAMP, HIPAA programs, per your agreements with Microsoft) keep applying to the data SteadyState stores there, because that data never leaves it.

SteadyState Technologies itself holds no security certifications today. We do not claim SOC 2, HIPAA, or FedRAMP for our company. Our approach is architectural: we hold nothing, so most vendor-risk questions collapse to questions about your own Microsoft tenant.

SteadyState's central control is that finalized governance records (approved or rejected decisions, adjourned meetings and their agenda items) cannot be edited or deleted:

• Enforcement is a C# plugin that runs server-side in Dataverse as a synchronous pre-validation step, before the database transaction opens, so a refused edit never reaches the database.
• The form, the Web API and Excel all reach the same check, so calling the API directly gets the same refusal.
• One deliberate exception exists: the SteadyState System Override security role – an explicit break-glass bypass your administrator can grant. When auditing is on for the environment, every write it permits is captured in the Dataverse audit log.
• The compliant change path is amendment: a new linked decision through the same approval; on approval the original is automatically marked Superseded and stays in the register.