We use access controls, encryption, monitoring, vulnerability management, and an incident response process to protect the services and data we manage. Our security program is aligned with the SOC 2 Trust Services Criteria.

Yes. Our applications use TLS/SSL to encrypt data in transit. Production databases and managed storage systems are encrypted at rest.

Access to sensitive systems and customer information is limited to authorized team members who need it for their roles. We apply least privilege and conduct quarterly access reviews for team members with access to sensitive systems.

Production data is hosted in managed cloud databases in the United States, unless otherwise agreed in writing.

Our Trust Center currently lists a SOC 2 Type 1 report, available by request. The report provides the applicable scope and details of the assessment.

Yes. We engage an independent third party to perform penetration testing at least annually. We also perform vulnerability scanning and monitor for threats affecting our services.

We maintain an incident response process covering escalation, mitigation, and customer communication when appropriate. We log and monitor cloud services and application events to help detect security and operational issues.

We use managed provider backup and recovery services to reduce the risk of data loss. Monitoring alerts our team when failures affect users, and we maintain business continuity and disaster recovery practices.

We assess vendors before authorizing them and perform reviews appropriate to the sensitivity of the services and data they handle.

You can request the available documents, including our SOC 2 Type 1 report, through this Trust Center.