Trust Center
Our security, privacy, and legal documents. No account, no request form.
At a glance
- GDPR Compliance Compliant as processor and controller. SOC 2 Type II audit due September 2027. Read more →
- ID + email Personal data we hold Your team's sign-in ID and username or email. We never log IP addresses; Stripe holds billing details. Read more →
- Security keys Staff access Required for production and corporate systems, no exceptions. Reviewed quarterly; revoked the day someone leaves. Read more →
- 48 h Breach notification We tell customers within 48 hours of discovering a breach, and regulators and affected people as the law requires. Read more →
Security
-
Security Measures
Access control, encryption, network, patching, monitoring, and audits. Annex II of our DPA.
-
API Architecture
Components, data flows, and trust boundaries, with a network diagram.
-
Incident Response Plan
Who leads, how we respond, and when we notify.
-
Continuity Plan
Recovery objectives and how we handle each failure.
-
Risk Assessment
Risks rated by likelihood and impact, with mitigations.
-
Vulnerability Disclosure Policy
Scope, safe harbor, and what to expect when you report a vulnerability.
Privacy
-
GDPR
Where we are processor or controller, and which document meets each GDPR requirement.
-
Privacy Policy
What personal data we hold, why, and for how long.
-
Approved Subprocessors
Who processes personal data for us, and for what. Annex III of our DPA.
-
Data Protection Impact Assessment: Uploads
Why publishing uploaded malware is fair to the people named in it.
Legal
-
Terms of Service
Usage rules, support tiers, liability, and cancellation.
-
Data Processing Agreement
Processor terms, with Standard Contractual Clauses for EEA, UK, and Swiss transfers.