Security posture, in one place.
The controls we run, the compliance status we hold, and how to report a security issue - the canonical reference for security review.
Compliance status
GDPR
Self-assessed compliantCCPA
Self-assessed compliantSOC 2 Type II
In progressISO 27001
Gap analysis"Self-assessed" means internal legal review - the verifiable evidence is what we publish: the DPA, subprocessor list, retention schedule, and the controls below. Independent assurance for the control environment is in progress under the SOC 2 Type II program. Scope, basis, review dates, and the compliance roadmap live in the Trust Center.
Security practices
Encryption in transit
TLS 1.2+
All API and portal traffic encrypted in transit.
Encryption at rest
AES-256
Database and storage encrypted at rest.
API key storage
HMAC hashed
Keys stored as one-way hashes; plaintext shown once.
Audit logging
All admin actions
Administrative actions logged for review.
Dependency scanning
Continuous
Automated vulnerability scanning in CI.
Abuse & extraction monitoring
Continuous
We monitor automated abuse and attempts to replicate service functionality. Depending on the circumstances, controls may restrict, throttle, or suspend access. Customers can contact support to resolve legitimate evaluation or capacity issues.
Access control
RBAC + scoped MFA
Role-based access control with owner, admin, developer, billing, and read-only roles. Self-service two-factor enrollment with recovery codes, optional organization-enforced MFA, and mandatory 2FA for privileged staff access.
Security & data-handling documents
Data Processing Agreement
GDPR Art. 28 processor terms, SCCs, audit rights
Subprocessors
Every processing service - purpose, region, transfer mechanism
Zero Retention Policy
How submitted content is handled
Incident Communication
How and when we notify customers
Report a Security Issue
Coordinated disclosure & safe harbor
Independent Assurance
Review scopes, dates, assessors, limitations
Trust Center
Procurement umbrella - all documents