Last updated: October 2026.
Independent audits
- SOC 2 Type 2. An independent CPA firm examined our controls for Security, Availability and Confidentiality for the period May 29, 2024 to May 31, 2025, with no exceptions noted. An examination covering the following period is in progress.
- Penetration testing. An independent third party tests our application and production environment at least annually.
- Our SOC 2 report and redacted penetration test summaries are available under NDA. Request a copy.
Where your data lives
- Hosted in the United States on Amazon Web Services (AWS) and MongoDB Atlas.
- Customer data is separated by organization, and access is enforced by role-based permissions on every request.
Encryption
- Encrypted in transit with TLS and encrypted at rest.
- AES-256 is our standard for data encryption, with keys managed in AWS Key Management Service.
Access control
- Least-privilege, role-based access for staff, with unique user IDs.
- Multi-factor authentication is required for staff access to our systems.
- Access is reviewed quarterly and removed promptly when people leave.
- Production databases are not publicly accessible.
Application security
- Every code change is peer reviewed and analyzed with automated static analysis before release.
- Dependencies are scanned for known vulnerabilities weekly.
- AWS WAF with managed rule sets, bot control and rate limiting protects our primary application.
- Vulnerabilities are fixed on defined timelines: critical in 15 days, high in 30, medium in 60, low in 90.
Monitoring and incident response
- Threat detection and audit logging (Amazon GuardDuty, AWS CloudTrail) with alerts to our engineering team.
- A documented incident response plan with severity levels, escalation paths, and root cause analysis.
Availability and backups
- Application services run across multiple availability zones, and database storage is replicated across three.
- Production databases are backed up continuously with 35-day point-in-time recovery, plus daily snapshots kept for 180 days, all encrypted.
- Backup and restore capabilities are tested at least annually.
People
- Security awareness training for all personnel, with background screening for new hires.
- Staff acknowledge our security policies.
Privacy
- Read our Privacy Policy.
- We process customer data on your behalf and do not sell personal data.
- The platform has no AI features, and it does not send customer data to AI services.
Subprocessors
- Amazon Web Services (hosting) and MongoDB Atlas (database), both in the United States.
Report a vulnerability
Trust Center
