Certifications
SOC 2 Type II (annual). ISO 27001 in progress (target: 2026 Q3). GDPR-compliant DPA available on request.
SECURITY
Security Overview
Our security posture, the certifications we hold, and the engineering practices that back them. The full SOC 2 report is available under NDA.
LAST UPDATED
April 2026
Encryption
AES-256 at rest. TLS 1.2+ in transit. Customer-managed encryption keys on Custom plans (BYOK via AWS KMS).
Access control
SSO/SAML on Pro and Custom plans. SCIM provisioning on Custom. Role-based access with granular permissions. Audit logs for every privileged action — immutable, exportable.
Vulnerability management
Continuous dependency scanning (Dependabot, Snyk). Quarterly third-party penetration tests. 24-hour patch SLA for critical CVEs.
Incident response
On-call rotation, 99.95% target. Incident timeline published within 5 business days at /legal/security/incidents. Customers notified within 24 hours of any incident affecting their data.