Security

Boring, in the best way.

Independent audits, transparent processes, and zero-retention by default. Here's how we look after your data.

SOC 2 Type II

Audited annually

GDPR

EU + UK

CCPA

California ready

ISO 27001

In progress (Q3)

AES-256 at rest, TLS 1.3 in transit. Per-tenant keys, rotated on a schedule.

All third-party model calls go through providers with contractual zero-retention.

SAML 2.0 SSO and SCIM 2.0 provisioning on Enterprise. Granular RBAC.

Every action — human or agent — is logged, attributed, and exportable.

Choose US, EU, or APAC data residency on Pro+ plans. Data stays put.

Public program with up to $10k payouts for critical issues.

Sub-processors

Who we trust with what.

Updated monthly. Customers get 30-day advance notice on any change.