We take trust seriously.
We build on the web's most trusted infrastructure and hold ourselves to a high standard of security practice, because our clients' data and reputations depend on it.
Here’s how we protect your data.
Data encryption
All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). We never store plaintext credentials.
Access control
Access follows least-privilege. All internal tooling requires MFA. Access is revoked within one business day of offboarding.
Monitoring & alerting
Cloudflare provides DDoS mitigation and WAF protection at the edge. Application health is monitored via infrastructure-level alerting.
Incident response
We maintain a documented incident response plan with defined severity tiers, notification timelines, and post-incident reviews.
We hold ourselves to these practices.
Data security
- All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
- No payment card data stored, payments handled by PCI-compliant processors
- Data classified and handled according to sensitivity level
Infrastructure security
- Production hosted on Vercel, SOC 2 Type II certified infrastructure
- Cloudflare provides edge DDoS protection and WAF
- All deployments are git-triggered CI/CD, no direct server SSH access
- Secrets managed via Vercel's encrypted environment variable system
Access control
- Access Management Policy published and signed by all team members
- All systems require MFA; access follows least-privilege
- Password Policy published and enforced across all internal tooling
- Access revoked within one business day of offboarding
Vulnerability management
- Code scanning on all repositories via GitHub Advanced Security and OneLeet
- Dependencies monitored for known CVEs via automated tooling
- Security patches applied within 24h (critical) or 72h (high)
- Responsible disclosure accepted at [email protected]
We’re working toward SOC 2.
We are actively pursuing SOC 2 Type II certification, managed through OneLeet.
What is SOC 2?
SOC 2 (System and Organization Controls 2) is a framework developed by the AICPA that evaluates a service organization's controls across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A Type II report covers how those controls operated over an extended period, typically 6–12 months, giving enterprise clients independent assurance that our practices match our claims.
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
SOC 2 Type II
SOC 2 Type II is an independent audit of our security, availability, and confidentiality controls over a minimum 6-month observation period. We are currently in the preparation phase.
- Preparation
- Audit window
- Report issued
These vendors process data for us.
Third-party services we use to deliver our platform. Each has been evaluated for security posture.
No match
We log every security change here.
- MayDeployed Doppler for secrets management across all projects.
- FebInitiated SOC 2 Type II readiness engagement with OneLeet.
- DecPublished Access Management Policy and Password Policy; signed by all team members.
- NovMigrated database infrastructure to MongoDB Atlas with encryption at rest enabled.
- OctEnabled automated code scanning across all repositories via GitHub Advanced Security and OneLeet.
- AugDeployed Okta SSO and MFA across all internal systems.
- JanMigrated all production deployments to Vercel's SOC 2-certified infrastructure.
- JanCompleted security review of third-party integrations and analytics pipeline.
Found a vulnerability? Tell us.
Found a security issue? Please report it responsibly. We take all disclosures seriously and will respond within 3 business days.
We build on the web's most trusted infrastructure and hold ourselves to a high standard of security practice, because our clients' data and reputations depend on it.
Security posture
- Data Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.2+). We never store plaintext credentials.
- Access Control: Access follows least-privilege. All internal tooling requires MFA. Access revoked within one business day of offboarding.
- Monitoring & Alerting: Cloudflare provides DDoS mitigation and WAF protection at the edge. Application health monitored via infrastructure-level alerting.
- Incident Response: Documented incident response plan with defined severity tiers, notification timelines, and post-incident reviews.
We hold ourselves to these practices.
- Data Security: AES-256 encryption at rest and TLS 1.2+ in transit. No payment card data stored. Data classified by sensitivity.
- Infrastructure Security: Hosted on Vercel (SOC 2 Type II certified). Cloudflare DDoS/WAF. Git-triggered CI/CD, no direct SSH. Secrets via Vercel encrypted environment variables.
- Access Control: MFA required on all systems. Least-privilege access. Access revoked within one business day of offboarding.
- Vulnerability Management: Code scanning via GitHub Advanced Security and OneLeet. Critical patches within 24h, high within 72h. Responsible disclosure: [email protected].
We’re working toward SOC 2.
SOC 2 Type II - Status: In Progress (Preparation phase). Managed through OneLeet. SOC 2 Type II is an independent audit of security, availability, and confidentiality controls over a minimum 6-month observation period.
These vendors process data for us.
- Anthropic (Claude): AI assistant for development & internal work
- Amazon Web Services: Cloud infrastructure
- Cal.com: Meeting scheduling
- Cloudflare: CDN, WAF, DDoS protection
- Doppler: Secrets & environment variable management
- GitHub: Source code, CI/CD integration & code scanning
- Google Workspace: Email, calendar, and document collaboration
- Linear: Project & issue tracking
- MongoDB: Database infrastructure
- Okta: Identity & access management (SSO, MFA)
- OneLeet: SOC 2 compliance management & code scanning
- Slack: Team communication & collaboration
- Tella: Screen recording & video walkthroughs
- Toggl: Time tracking
- Zoom: Video conferencing & client calls
- Vercel: Production hosting & CI/CD
Found a vulnerability? Tell us.
Found a security issue? Report it responsibly. We respond within 3 business days.