Security & compliance

Security is the product.

Built for enterprises that take risk seriously. SOC 2 Type II, ISO 27001 and a security team that treats every release like an audit.

Compliance

Certified, audited, documented.

Independently audited annually against trust services criteria.

Information security management system certified to international standard.

Full data subject rights, DPA available, EU-hosted option.

California consumer privacy rights honored globally.

BAA available on Enterprise plans for healthcare workloads.

All payments processed by Stripe — we never store card data.

Controls

TLS 1.3 in transit. AES-256 at rest. Field-level encryption for sensitive data.

SAML SSO with Okta, Azure AD, Google Workspace. SCIM provisioning included on Enterprise.

Per-tenant data isolation enforced at the database row level and in application code.

EU and US regions available. Choose where your data lives at workspace creation.

Every admin action, integration call and data export is logged and exportable.

Production access is just-in-time, MFA-gated, and reviewed quarterly.

Responsible disclosure

We acknowledge every report inside 24 hours, fix verified issues fast, and reward qualifying findings through our bug bounty program.

SOC 2 report, ISO certificate, pen test summary, architecture diagrams and questionnaire responses — sent on request.