Security

How we secure the platform that secures you.

Security is not a checkbox. Below is what we do — encrypted data planes, separated duties, audited controls and a real disclosure program.

Compliance

Where we are. Where we're going.

Type II audit in progress. Type I report available on request under NDA.

Aligned with controls. Formal certification targeted within 12 months.

EU-hosted option. DPA available. Data subject rights honored within statutory windows.

Controls

Encryption at rest. AES-256 across all customer data stores. Keys rotated quarterly.
Encryption in transit. TLS 1.3 enforced. Modern cipher suites only.
Tenant isolation. Row-level security plus per-tenant encryption keys.
Access controls. Hardware MFA mandatory. Least-privilege RBAC. Just-in-time access to production.
Audit logging. Every administrative action logged, exported and retained for 7 years.

Application security

SDLC with security review. Every PR scanned. Sensitive changes require security sign-off.
Dependency scanning. SBOM-tracked. Critical CVEs patched in under 24 hours.
Annual pen test. External pen test on the platform. Report summary available under NDA.
Bug bounty. Public program with payouts up to €10,000 for critical findings.

Disclosure

Email [email protected] with details. PGP key and policy at /.well-known/security.txt. We acknowledge within one business day and triage within five.