Security

Your data is encrypted in transit and at rest, access is least-privilege and audited, and the building blocks your account runs on are maintained and patched centrally. When a fix lands, every account benefits the same hour rather than waiting on individual upgrades.

Each account's data is logically separated so one tenant can never read another's. Identity is issued and verified by a single source of truth, and every product checks that identity on each request. Isolation is enforced in the data layer, not just the application layer.

All traffic uses TLS, and stored data is encrypted at rest with managed keys. Secrets are held in a dedicated secret store, never in source control, and are resolved at runtime rather than baked into images.

We build to recognized industry standards and align our controls with frameworks such as SOC 2. For the current state of our certifications, attestations, and the controls behind them, see the security and compliance page and our Trust Center.

We use a small set of vetted infrastructure subprocessors, each under a data processing agreement. The current list and how we handle data are described in our data processing documentation and privacy policy.

We welcome reports from researchers. Email [email protected] with steps to reproduce, and follow our responsible disclosure policy. Please give us a reasonable window to remediate before any public disclosure; we do not pursue good-faith researchers.

Incidents are triaged by severity with defined acknowledgement and update targets, and material incidents receive a published post-incident review. Current service health is on the status page.