Trust Center
Enterprise-grade security, compliance, and data protection. Built for Fortune 500 companies managing AI regulatory compliance.
Security Controls
Technical and organizational measures protecting your data at every layer.
Encryption at Rest
AES-256 encryption for all stored data via OCI Block Volume encryption with FIPS 140-2 Level 3 HSM key management.
Encryption in Transit
TLS 1.2+ enforced on all connections with HSTS enabled and HTTP/2 support.
Tenant Isolation
Every database query is scoped to the authenticated organization. No shared data between tenants.
SSO / SAML
Enterprise single sign-on via SAML 2.0 and OIDC. Compatible with Okta, Azure AD, OneLogin, and custom IdPs.
RBAC
Role-based access control with admin, member, and viewer roles. Backend enforces permissions independently.
Audit Logging
Comprehensive audit trail of all API requests, data mutations, and authentication events with tamper-evident storage.
Automated Backups
PostgreSQL snapshots every 6 hours with 30-day retention. RPO: 6 hours, RTO: 4 hours.
Vulnerability Scanning
Automated dependency scanning via Dependabot. Weekly security reviews of all production dependencies.
Compliance
Our compliance posture and certification roadmap.
| Framework | Status | Target / Note |
|---|---|---|
| SOC 2 Type I | Planned | Q3 2026 |
| SOC 2 Type II | Planned | Q1 2027 |
| GDPR | Compliant | DPA Available |
| CCPA / CPRA | Compliant | Current |
| EU AI Act | Platform Supports | Current |
| ISO 27001 | Planned | Q2 2027 |
Sub-processors
Third-party services that process data on behalf of our customers.
| Provider | Purpose | Location | Certifications |
|---|---|---|---|
| Oracle Cloud Infrastructure | Cloud hosting & compute | United States | SOC 2, ISO 27001, FedRAMP |
| Clerk | Authentication & SSO/SAML | United States | SOC 2 Type II |
| Stripe | Payment processing | United States | PCI DSS Level 1, SOC 2 |
| SendGrid (Twilio) | Email delivery | United States | SOC 2, ISO 27001 |
| Anthropic | AI compliance analysis | United States | SOC 2 Type II |
Enterprise Documents
Available for enterprise customers and prospects in active procurement.
Service Level Agreement (SLA)
Uptime commitments, support tiers, and service credits
Data Processing Agreement (DPA)
GDPR-compliant data processing terms and sub-processor disclosures
Security Whitepaper
Architecture, controls, and compliance posture overview
Incident Response Plan
Detection, response, recovery, and communication procedures
Security Questionnaire
Pre-filled responses for enterprise procurement
Request Documents or Report a Vulnerability
For security inquiries, document requests, or to report a vulnerability, contact our security team.