Security & Compliance
Last reviewed:
Our approach
Security is part of the architecture from day one, not a layer added after launch.
Data protection
- Encryption: all traffic over TLS 1.2+, and encryption at rest through our cloud provider.
- Isolation: logical separation of each tenant's data in our multi-tenant platforms.
- Backups: encrypted daily backups with scheduled restore testing.
Access control
- Role-based permissions and least-privilege access for our own team.
- Audit logs for sensitive operations.
- Single sign-on (SSO) available to Enterprise customers.
Secure development
- Mandatory code review and automated tests before every release.
- Regular dependency scanning for known vulnerabilities.
- Secrets kept in protected environment variables, never in source code.
This website
Security headers (CSP, HSTS and more), server-side input validation, rate limiting and spam protection on every form.
Reporting a vulnerability
If you discover a security issue, email us at the address below with steps to reproduce. We respond within three business days and ask that you do not disclose publicly before it is fixed.
Frequently asked questions
Where is data hosted?
Our platforms run on major cloud providers in data centres certified to ISO 27001 and SOC 2. Enterprise customers can choose the hosting region or deploy on their own infrastructure.