Trust Center

SSO via SAML 2.0 / OIDC, with MFA enforced at your identity provider. MFA available for local accounts and mandatory for all admin access to our infrastructure. Role-based access control down to data set and feature level, with every access change in the audit log.

Every customer runs in a dedicated Google Cloud project: single-tenant, with no shared data, network or credentials. Backend services are never exposed to the internet, only hardened API endpoints. Production and development are strictly separated, and production data never leaves production.

We map our own dependencies in our own platform. Every supplier, service and single point of failure in our stack is tracked, ranked by impact and exercised. We hold ourselves to what we sell.

Mandatory code review and automated security scanning on every code change. Continuous dependency scanning for known vulnerabilities. STRIDE threat modeling for new features. Fixes ship on defined SLAs: critical within 24 hours, high within 7 days.

Company devices are inventoried, full-disk encrypted, patched on defined SLAs and protected by anti-malware. Every device must meet our security baseline before it touches a company system.

Centralized logging across infrastructure, application and identity, monitored with Google Security Command Center. Documented incident response plan, tested in annual tabletop exercises. Breach notification to authorities within 72 hours under GDPR and FADP, and to customers as set out in our DPA.

Company devices are inventoried, full-disk encrypted, patched on defined SLAs and protected by anti-malware. Every device must meet our security baseline before it touches a company system.

A formal risk register covering security, operational, compliance and third-party risk. Each risk has an owner and a treatment, ranked by business impact with the same method our customers use in the product.

Every subprocessor is assessed before onboarding and reviewed annually. Data location, certifications and contractual safeguards are documented. The full list is published below.

CSA STAR Level 1 self-assessment published. GDPR and Swiss FADP compliant processing with a signed DPA for every customer. Controls aligned with NIST CSF 2.0 and ISO 27001, 27017 and 27018. Hosted on ISO 27001 and SOC 2 Type II certified infrastructure. Independent penetration testing on request. ISO 27001 and SOC 2 Type II on our roadmap.

TLS 1.2 and 1.3 in transit, AES-256 at rest. Keys generated and rotated in Google Cloud KMS on FIPS 140-2 validated hardware. Aggregated, anonymized usage data may help improve the platform.

Daily encrypted backups kept for 30 days, point-in-time recovery for 7 days, stored in separate zones. Restores tested regularly. RPO of 24 hours, or 1 hour with point-in-time recovery. Yes, we run the exercises in Resimate.