Trust centre

Platform security, data handling, compliance, and sub-processors.

Trust centre

Last updated: 2026-04-22

We build a security product, so we take our own security seriously. This page summarises what we do and how to verify it.

Platform security

  • TLS everywhere. TLS 1.2 minimum, 1.3 preferred. HSTS preloaded. Weekly scan for weak ciphers.
  • Authentication. Supabase Auth with bcrypt-hashed passwords, optional TOTP, and social providers (Google, Microsoft).
  • Authorisation. Role-based within organisations; platform admin actions require a separate admin session on a different subdomain.
  • Secrets. All third-party credentials you connect (integration API keys, OAuth tokens) are encrypted at rest with AES-256-GCM under a versioned application encryption key — rotating the key re-encrypts affected rows under the new version rather than a single static per-tenant key. Platform secrets (database URLs, signing keys, provider API keys) are environment-based configuration, never committed to code.

Data handling

  • Storage. Supabase-hosted PostgreSQL, single region today. Per-tenant regional data-residency pinning (EU / US / APAC) is architected in our codebase but not yet in production — see the Sub-processor list for current status.
  • Retention. Scan data retained for the life of the subscription plus 90 days. Account data purged within 30 days of deletion. Billing records retained 7 years.
  • Export. Full data export is available from the dashboard or on written request.

Compliance

  • GDPR / UK GDPR / UAE PDPL — compliant by design; DPA available.
  • SOC 2 Type II — assessment begins Q3 2026, target completion Q1 2027.
  • PCI DSS — we do not store card data; Stripe handles the PCI-relevant scope.

Vulnerability disclosure

We run a responsible (coordinated) disclosure programme — see the full Responsible Disclosure Policy. Email [email protected] with findings; PGP key on request. We aim to acknowledge within 48 hours and will recognise researchers publicly (with permission) on our Hall of Fame. We do not currently run a paid bug-bounty programme.

Uptime and incidents

  • Status page: see our status page for live uptime and per-service heartbeat.
  • Target uptime: 99.9% monthly.

Sub-processors

The authoritative, current list — including region and exactly what each sub-processor receives — is maintained on our Sub-processor list page. That page is the single source of truth; this page and our Privacy Policy both link to it rather than duplicate it.