Your data is yours
Documented exports use standard formats from standard databases. Contracts can define export timing, transition assistance and deletion after service termination.
Trust Center
Security, compliance, data ownership and continuity commitments
Review the controls built into the platform, the status of our SOC 2 and ISO 27001 work, data handling, export options and the contractual protections available if you leave the platform or the service becomes unavailable.
Compliance
Controls mapped to SOC 2 and ISO 27001
We are audit-ready for SOC 2 and ISO 27001 and publish the status of each program here. We do not claim an attestation until the auditor's report is issued. Independent audit: not yet performed.
SOC 2 Type II
Audit-readySOC 2 Trust Services Criteria are built into our controls, including an append-only, hash-chained audit trail per tenant.
ISO 27001
Audit-readyAnnex A controls for access, cryptography, operations security, supplier and incident management are built into the platform.
GDPR controls
Built inSelf-service export of everything held about a person, erasure across the platform services and every installed app that declares it, personal-data redaction in audit records, and a record of which Terms of Service version each user accepted.
OWASP ASVS L2
TrackedApplication Security Verification Standard maintained as a controls backlog, reviewed against current implementation.
For the architecture and the controls behind each line, see the Security page or request the security whitepaper and our pre-answered security questionnaire.
Your data
You own it, and you can take it with you
Published identity and integration standards
Identity uses OIDC, OAuth, SAML, LDAP and SCIM. Applications integrate through documented APIs, CloudEvents and webhooks, reducing migration work if a provider changes.
Customer-held keys for dedicated storage
For dedicated deployments: your database storage, its credentials and your object storage encrypted with a key you hold in your own cloud account, so withdrawing our access makes the data unreadable, including to us. Cache and event-stream storage remain on platform-managed keys.
Regional placement
Customer data can be placed in the US or EU region the customer needs.
You can leave
On exit, your data is returned in standard formats and then deleted from our systems on an agreed schedule. We keep the platform running through a defined transition window and support your migration off.
Export and service-continuity terms
The contract documents data export, transition assistance and continuity protections for a planned departure or a provider failure. Qualifying deployments receive a written brief covering data portability, transition assistance and exit terms — each becomes a clause in the agreement. Ask us for it.