Security practices

Data protection and access

• Customer data is encrypted in transit and at rest.
• Production access is limited to named operators using multi-factor authentication.
• Tenant access controls restrict customer data to the authorized organization and teams.
• Application activity and administrative actions are logged for investigation and review.

Backups and recovery

We back up production data and test database restoration. The latest documented test, on August 9, 2026, successfully restored the database.

That test did not cover a full application recovery. An off-region production backup is not currently in place.

Secure development

Each major release requires human approval. Automated reviewers support our development process. Security-relevant changes require the technical security lead’s approval.

Automated tests, dependency monitoring, and vulnerability scans support release review. Findings are tracked for remediation.

SOC 2 Type I: in progress

Our examination is in progress for the Security, Availability, and Confidentiality Trust Services Criteria. We do not yet hold a SOC 2 auditor’s opinion and are not certified.

Subprocessors and privacy

Request the current Platform subprocessor list from [email protected]. Subprocessor change notices follow the terms of your customer agreement.

Report a security issue

Email [email protected] or use our vulnerability report form. On-premises customers can also use their shared support channel.

We provide a first response within one business day. Business hours are Monday–Friday, 9 a.m.–6 p.m. U.S. Eastern, excluding U.S. federal holidays. This is a response commitment, not a resolution time.