Trust Center - placeholder release

Security posture and compliance status

We're building a permanent trust center. Until then, this page is the single source of truth for our compliance state. Anything not listed here as Operational is in audit progress or available under contract - we don't claim attestations we haven't earned.

Compliance attestations

SOC 2 Type II

Audit in progress

Audit window underway with our auditor. Speak to sales for current observation period and projected report date.

ISO 27001

Audit in progress

Stage-1 readiness assessment scheduled. Detailed timeline available under NDA.

HIPAA

Available under contract

BAA available for Enterprise tenants on request. Healthcare-specific controls reviewed per deployment.

GDPR

Available under contract

Data Processing Agreement (DPA) and EU SCCs available on request. EU data residency available for Enterprise.

Operational controls

These controls are live in production today, enforced at the API layer and database, and reviewed in CI on every change.

Identity & access

  • Tenant-scoped authentication on every API endpoint
  • Optional 2FA for personal accounts; SSO required for enterprise tenants
  • Per-project permission templates with deny-by-default semantics
  • Tenant kill-switch suspends logins, writes, and background jobs immediately

Data protection

  • TLS 1.2+ in transit; AES-256 at rest for object storage and database backups
  • Object keys scoped to tenant + project; presigned URLs expire in ≤10 minutes
  • DLP enforcement on uploads (max size + extension allowlist) before presign
  • Soft-delete with audit trail; hard-delete jobs respect retention labels per tenant

Tenant isolation

  • Every database row carries `tenant_id`; cross-tenant joins are statically disallowed in CI
  • Sockets join `tenant:<id>` and `project:<id>` rooms only - no global broadcasts
  • Cache keys, queues, and search indices are tenant-prefixed
  • GitHub webhooks resolve tenant by `installation_id` before any state mutation

Observability & response

  • Structured logs include `tenantId`, `userId`, `projectId`, `requestId` (no secrets, no PII)
  • Per-tenant metrics on rate-limited endpoints, error rate, and storage usage
  • Public status page (coming) and Slack-bridged incident channel for paid tenants
  • Security incident response: triage <1h, customer notification per contractual SLA

Need detailed audit status, a security questionnaire, or a DPA?

We share current SOC 2 / ISO 27001 timelines, security questionnaires, sub-processor lists, and signed DPAs under NDA with enterprise prospects and customers.

Talk to security Compare plans