Compliance is our product.
Trust is how we prove it.
We help cloud teams reach SOC 2, ISO 27001, and HIPAA. We hold our own infrastructure to the same bar — in the open, with evidence you can request today instead of waiting on a sales call.
Our core compliance posture.
Certified
Certificate available
Attested
Report available
Pentested
Summary available
Compliant
DPA available
The controls behind the certifications
A summary view. Full control detail lives in the SOC 2 report and ISO 27001 Statement of Applicability — both available in the document request center below.
Data Protection
Data encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys are managed and rotated through AWS KMS.
IAM Policies
Least-privilege roles, mandatory MFA, and SAML SSO. Every access change is logged and reviewed quarterly.
Cloud Security
Hosted on AWS across multiple availability zones. We scan customer clouds through read-only, agentless roles — never write access.
Request the evidence
Some reports are gated by mutual NDA, since they describe control detail we only share with prospective and current customers.
-
NDA requiredSOC 2 Type II reportIssued by independent CPA firm
-
NDA requiredISO/IEC 27001:2022 certificateIssued Mar 2026
-
NDA requiredPenetration test summaryAnnual external assessment, executive summary
-
PublicSubprocessor listAlways current — see below on this page
-
PublicInformation security policy summaryControl overview
Every third party that touches your data
And exactly what each one is allowed to see. We add a subprocessor here before it ever touches production data, not after.
| Subprocessor | Purpose | Region | Data categories | Status |
|---|---|---|---|---|
| Amazon Web ServicesINFRASTRUCTURE | Primary hosting, compute, and storage | US (us-east-1, us-west-2) | Account metadata, scan results, encrypted backups | Active |
| SlackCOMMUNICATIONS | Customer-configured alert delivery | US | Workspace webhook URL, alert text | Active |
| StripePAYMENTS | Payment processing and subscription management | Global | Billing details, email address | Active |
| HubSpotCOMMUNICATIONS | Customer relationship management (CRM) | US | Contact information, company details | Active |
| GoogleINFRASTRUCTURE | Workspace email and internal analytics | Global | Internal communications, telemetry | Active |
| CloudflareINFRASTRUCTURE | Content delivery network (CDN) and WAF | Global | IP addresses, traffic logs | Active |