Trust Center

Our security program is built around defense-in-depth principles, production monitoring, access review, and incident response planning. Security reviews are part of the engineering process, and enterprise customers can review architecture, data flow, and control posture during procurement.

Customer data is protected with encrypted storage patterns, encrypted backups where applicable, and modern TLS transport. Enterprise security review can cover key management, backup retention, and hosting architecture for your rollout.

Role-based access helps teams control who sees data, workflows, and admin settings. SSO, SCIM, audit logs, and retention requirements are scoped as part of enterprise rollout and security review.

Your data is not used to train foundation models. Data processing agreements are available on request, and enterprise privacy review can cover retention, deletion, subprocessors, and regional requirements.

We engage independent security firms to conduct penetration testing at least annually, covering our application, infrastructure, and APIs. Findings are remediated on a risk-prioritized timeline: critical within 24 hours, high within 7 days. Executive summaries of our most recent assessment are available under NDA.

We maintain a curated list of subprocessors and minimize the number of third parties with access to customer data. All subprocessors undergo security review before onboarding. We provide 30 days advance notice before adding any new subprocessor, giving you time to review and raise concerns.