Security

How we secure the platform that secures you.

Security is not a checkbox. Below is what we do — encrypted data planes, separated duties, audited controls and a real disclosure program.

Compliance

Where we are. Where we're going.

SOC 2 Type II — audit in progress

Type II audit in progress. Controls aligned with SOC 2 practices, under review.

ISO 27001 — certification planned

Aligned with controls. Formal certification targeted within 12 months.

GDPR

EU-hosted option. DPA available. Data subject rights honored within statutory windows.

Controls

Data protection.

Encryption at rest. AES-256 across all customer data stores. Keys rotated quarterly.
Encryption in transit. TLS 1.3 enforced. Modern cipher suites only.
Tenant isolation. Row-level security plus per-tenant encryption keys.
Access controls. Hardware MFA mandatory. Least-privilege RBAC. Just-in-time access to production.
Audit logging. Every administrative action logged, exported and retained for 7 years.

Application security

How we ship code.

SDLC with security review. Every PR scanned. Sensitive changes require security sign-off.
Dependency scanning. SBOM-tracked. Critical CVEs patched in under 24 hours.
External security review. External penetration test planned for the platform.
Responsible disclosure. Coordinated vulnerability reporting channel via security.txt.

Disclosure

Found something? Tell us.

Email [email protected] with details. PGP key and policy at /.well-known/security.txt. We acknowledge within one business day and triage within five.

Trust, in plain terms.

A security product has to earn trust before it earns a deployment. This page describes how we protect the platform and your data: encryption in transit and at rest, isolation between tenants, least-privilege access, audit logging and a development lifecycle with regular security testing.

If your evaluation needs more detail — security questionnaires, documentation or a conversation with the team — contact us and you will get specifics, not marketing. You can also review how the platform is structured.