Security & trust, in writing.
Your customers' conversations are some of the most sensitive data your business holds. Here's exactly how we secure them.
SOC 2 Type II
In progress · Q3 2026
Pen-tested annually. Bridge letter available on request.
GDPR aligned
Live
DPA available; EU representative via Prighter.
ISO 27001
Roadmap · 2027
Aligned controls today; cert process to begin.
Data residency
EU · IN · US
Pick at workspace creation; included on Business plan.
Defense in depth
Five layers, all observable
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Per-workspace KMS keys (BYOK) on Business + Enterprise.
Key management
AWS KMS / GCP KMS-backed key hierarchy. Customer keys never leave their KMS. Quarterly rotation.
Data isolation
Per-tenant database schema with row-level isolation. Each workspace runs queries against only its rows.
Infrastructure
GCP and AWS multi-region. RPO 15min, RTO 1h. Daily backups, 365-day retention, encrypted.
Your data
What you can do
- Export everything in JSON or CSV from Settings → Privacy.
- Delete a contact / workspace; 30-day soft-retention then hard-delete.
- Per-contact access log (who viewed what, when).
- Data Processing Agreement (DPA) on every plan.
- EU representative via Prighter for GDPR data subject requests.
- Audit log of every settings change, exportable to SIEM.
Subprocessors
The vendors we use, and where
| Vendor | Purpose | Region |
|---|---|---|
| Google Cloud (GCP) | Primary compute and storage | EU / US / IN |
| AWS | KMS, secondary compute (BYOK customers) | EU / US |
| MongoDB Atlas | Primary database | EU / US / IN |
| Redis Cloud | Session store, queues | EU / US / IN |
| Stripe | Payment processing | US (PCI-DSS L1) |
| Postmark | Transactional email | US |
| Vercel | Marketing site hosting | Global edge |