Encrypted everywhere
TLS in transit, AES-256 at rest, KMS-managed keys, AWS US regions.
Trust center
Security you can hand to your auditor
Certifications, subprocessors, uptime, and the documents behind them — current versions, no NDA required for the summaries.
Signal workspace
Validated, routed, acknowledged.
Partner rules checked
Human decisions drafted
Receipts attached
SOC 2
Type II report available
HIPAA
attestation + BAA
ISO 27001
certificate + SoA
99.94%
30-day delivery SLA
How your data is handled
Tamper-proof history
7-year WORM retention with nightly reconciliation — your audit trail can't be edited, including by us.
Least-privilege access
Staff access is role-gated, MFA-enforced, and every admin action lands in an immutable log.
Common diligence questions
Can our auditor get access?
Yes — read-only auditor seats scoped to your workspace, with watermarked exports. No shared logins.
Where does data live?
AWS US regions. EU residency is on the roadmap; ask if it's a requirement.
Do you sign BAAs?
Standard BAA on Enterprise, with protective modifications reviewed case-by-case.
Pen tests?
Annual third-party tests; the latest redacted summary is in the document set.
Need the full reports?
SOC 2, ISO SoA, and pen-test summaries under NDA within one business day.