Security and trust.
Customer data is held in trust. These are the controls that keep it.
- Encryption
- All data is encrypted in transit and at rest, with AES-256.
- Authentication
- Multi-factor authentication and OAuth 2.0 protect every sign-in.
- Monitoring
- Security monitoring and threat detection run around the clock.
- Infrastructure
- The platform runs on redundant servers with regular backups.
Standards and compliance.
Engineering practice
- Protection against the OWASP Top 10 across every application surface
- Secure coding enforced through automated code analysis and peer review
- Dependency scanning, with automated alerts on every third-party package
- Regular security audits by the internal security team
Data protection law
- GDPR
- For customers with European end users, we provide Data Processing Agreements on request, support data subject access requests and keep records of processing activities.
- CCPA
- For customers with California end users, we support consumer rights requests, including access, deletion and opt-out.
- DPDP Act, 2023
- We follow data protection principles aligned with India's Digital Personal Data Protection Act, including purpose limitation, data minimization and storage limitation.
- IT Act, 2000
- We implement reasonable security practices and procedures as required under Section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Audits and testing
- Continuous automated vulnerability scanning of production infrastructure
- Penetration testing at least once a year by qualified security professionals
- An internal security review before every major feature release
No one holds more access than the work requires.
- Role-based access
- Permissions are scoped to Admin, Team Lead and CSM roles. Each role sees only the data and actions its responsibilities require.
- Least privilege
- Every user and service account holds the minimum access it needs. Elevated permissions require explicit approval.
- Access reviews
- Access rights are reviewed every quarter. Accounts dormant for 90 days are flagged and deactivated.
- Two-factor authentication
- Available to every user through an authenticator app, and mandatory for Admin roles that reach billing and user management.
- Session management
- Sessions time out after inactivity. Concurrent sessions are limited, and every session ends when a password changes.
A plan for the day something goes wrong.
- Detection
- Automated alerting on anomalous access patterns, spikes in failed authentication and infrastructure anomalies, monitored around the clock.
- Response
- Documented runbooks for every incident class. Critical incidents are escalated within 15 minutes, and customers hear within 4 hours of any incident that affects their data.
- Recovery
- Point-in-time database recovery, with full system restores tested every quarter. The recovery time objective (RTO) is under 4 hours.
- After the incident
- A documented root cause analysis for every incident. Findings go to affected customers, and process improvements are tracked to completion.
Found a vulnerability?
Report it responsibly to our security team.