We take Trust seriously
We build on the web's most trusted infrastructure and hold ourselves to a high standard of security practice, because our clients' data and reputations depend on it.
Our security posture
Data EncryptionAll data is encrypted at rest (AES-256) and in transit (TLS 1.2+). We never store plaintext credentials.
Access ControlAccess follows least-privilege. All internal tooling requires MFA. Access is revoked within one business day of offboarding.
Monitoring & AlertingCloudflare provides DDoS mitigation and WAF protection at the edge. Application health is monitored via infrastructure-level alerting.
Incident ResponseWe maintain a documented incident response plan with defined severity tiers, notification timelines, and post-incident reviews.
Security practices
-
Data Security
- All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
- No payment card data stored, payments handled by PCI-compliant processors
- Data classified and handled according to sensitivity level
- Data management and retention policy in development
-
Infrastructure Security
- Production hosted on Vercel, SOC 2 Type II certified infrastructure
- Cloudflare provides edge DDoS protection and WAF
- All deployments are git-triggered CI/CD, no direct server SSH access
- Secrets managed via Vercel's encrypted environment variable system
-
Access Control
- Access Management Policy published and signed by all team members
- All systems require MFA; access follows least-privilege
- Password Policy published and enforced across all internal tooling
- Access revoked within one business day of offboarding
-
Vulnerability Management
- Code scanning on all repositories via GitHub Advanced Security and OneLeet
- Dependencies monitored for known CVEs via automated tooling
- Security patches applied within 24h (critical) or 72h (high)
- Vulnerability Management Policy currently being formalized
- Responsible disclosure accepted at [email protected]
Compliance
SOC 2 (System and Organization Controls 2) is a framework developed by the AICPA that evaluates a service organization's controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A Type II report covers how those controls operated over an extended period, typically 6–12 months, giving enterprise clients independent assurance that our practices match our claims.
SOC 2 Type II is an independent audit of our security, availability, and confidentiality controls over a minimum 6-month observation period. We are currently in the preparation phase.
- Preparation
- Audit Window
- Report Issued
Subprocessors
- Anthropic (Claude)AI assistant for development & internal workCode, project context, client-related work details
- Amazon Web ServicesCloud infrastructureApplication data, server logs, infrastructure metadata
- Cal.comMeeting schedulingName, email, selected meeting times
- CloudflareCDN, WAF, DDoS protection, analyticsIP addresses, request metadata, anonymized analytics events
- DopplerSecrets & environment variable managementEnvironment variable names and values, API keys, secrets
- GitHubSource code, CI/CD integration & code scanningSource code, commit history, code scan results
- Google WorkspaceEmail, calendar, and document collaborationEmail communications, calendar events, internal documents
- LinearProject & issue trackingProject names, task descriptions, client-related work details
- MongoDBDatabase infrastructureApplication data (no PII stored)
- OktaIdentity & access management (SSO, MFA)Employee identity, authentication events
- OneLeetSOC 2 compliance management & code scanningCompliance documentation, control evidence, code scan results
- SlackTeam communication & collaborationMessages, files, client-related communications
- TellaScreen recording & video walkthroughsScreen recordings, client project content
- TogglTime trackingProject names, client names, time entry descriptions
- ZoomVideo conferencing & client callsMeeting recordings, participant names, chat messages
- VercelProduction hosting & CI/CDApplication code, environment variables, server logs
Security updates
- May 2026Deployed Doppler for secrets management across all projects.
- Feb 2026Initiated SOC 2 Type II readiness engagement with OneLeet.
- Dec 2025Published Access Management Policy and Password Policy; signed by all team members.
- Nov 2025Migrated database infrastructure to MongoDB Atlas with encryption at rest enabled.
- Oct 2025Enabled automated code scanning across all repositories via GitHub Advanced Security and OneLeet.
- Aug 2025Deployed Okta SSO and MFA across all internal systems.
- Jan 2025Migrated all production deployments to Vercel's SOC 2-certified infrastructure.
- Jan 2025Completed security review of third-party integrations and analytics pipeline.
We build on the web's most trusted infrastructure and hold ourselves to a high standard of security practice, because our clients' data and reputations depend on it.
Security posture
- Data Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.2+). We never store plaintext credentials.
- Access Control: Access follows least-privilege. All internal tooling requires MFA. Access revoked within one business day of offboarding.
- Monitoring & Alerting: Cloudflare provides DDoS mitigation and WAF protection at the edge. Application health monitored via infrastructure-level alerting.
- Incident Response: Documented incident response plan with defined severity tiers, notification timelines, and post-incident reviews.
Security practices
- Data Security: AES-256 encryption at rest and TLS 1.2+ in transit. No payment card data stored. Data classified by sensitivity.
- Infrastructure Security: Hosted on Vercel (SOC 2 Type II certified). Cloudflare DDoS/WAF. Git-triggered CI/CD, no direct SSH. Secrets via Vercel encrypted environment variables.
- Access Control: MFA required on all systems. Least-privilege access. Access revoked within one business day of offboarding.
- Vulnerability Management: Code scanning via GitHub Advanced Security and OneLeet. Critical patches within 24h, high within 72h. Responsible disclosure: [email protected].
Compliance
SOC 2 Type II - Status: In Progress (Preparation phase). Managed through OneLeet. SOC 2 Type II is an independent audit of security, availability, and confidentiality controls over a minimum 6-month observation period.
Subprocessors
- Anthropic (Claude): AI assistant for development & internal work
- Amazon Web Services: Cloud infrastructure
- Cal.com: Meeting scheduling
- Cloudflare: CDN, WAF, DDoS protection, analytics
- Doppler: Secrets & environment variable management
- GitHub: Source code, CI/CD integration & code scanning
- Google Workspace: Email, calendar, and document collaboration
- Linear: Project & issue tracking
- MongoDB: Database infrastructure
- Okta: Identity & access management (SSO, MFA)
- OneLeet: SOC 2 compliance management & code scanning
- Slack: Team communication & collaboration
- Tella: Screen recording & video walkthroughs
- Toggl: Time tracking
- Zoom: Video conferencing & client calls
- Vercel: Production hosting & CI/CD
Responsible Disclosure
Found a security issue? Report it responsibly. We respond within 3 business days.