Security & compliance
Workspace-level data isolation, encrypted transport, and a straight answer on where our compliance program actually stands.
Compliance status
We are not currently SOC 2, ISO 27001, or HIPAA certified. We build with those controls in mind — the isolation, access-control, and logging measures below — but we won't claim a certification we don't hold. If a signed DPA, security questionnaire, or a specific compliance framework is a requirement for your organisation, email [email protected] before you sign up so we can tell you honestly whether we're a fit today.
GDPR
We honour GDPR data-subject rights for every user, regardless of where you or your workspace are based — this includes access, correction, erasure, and portability of your data (see our Privacy Policy for the full process), and we respond to requests within 30 days. This is a data-protection commitment we hold ourselves to, not an audited third-party certification — GDPR is a regulation, not a certification scheme, so we don't describe it as one.
Data isolation
Multi-tenant, with isolation enforced at the database layer — every table that holds workspace data carries a workspace ID column, and Postgres row-level security policies enforce that queries only ever see rows for the workspace making the request. This isn't an application-layer filter that a bug could bypass; it's enforced by the database itself.
Encryption
TLS in transit for every connection to our apps and API. We do not currently offer customer-managed encryption keys (BYOK) or dedicated single-tenant deployments.
Access control
Authentication runs through our own JWT-based auth system, not a third-party identity provider. Every workspace has role-based permissions, and every write is checked against the caller's role for that specific workspace before it touches data.
Monitoring & incident response
We run our own error tracking and alerting on self-hosted infrastructure and monitor it continuously. If an incident affects your data, we will tell you directly — we don't currently commit to a fixed public SLA on response time, and we'd rather say that plainly than invent a number.
Last updated: August 7, 2026. For questions, contact [email protected].