Vendor Security Packet
Last updated: March 2026
This page consolidates all security, compliance, and data protection documentation for enterprise procurement and security review teams. Everything a vendor security reviewer needs is linked from here.
Our Security Posture
What we have:
- SOC 2-certified infrastructure providers
- Codebase continuously validated for SOC 2 readiness
- Fully local Docker deployment option (telemetry disabled) for Enterprise POCs
- TLS 1.2+ encryption, AES-256 at rest
- OAuth 2.0 via GitHub/Google
- RBAC with 4 org roles + superadmin
- Tenant isolation at query level (49 routes)
- Audit logging, Sentry error monitoring
- Rate limiting (Redis, fail-open)
- Deterministic compliance engines
- GDPR-aligned DPA with SCCs
In progress:
- SOC 2 Type II certification — underway, expedited on engagement request
- ISO 27001 certification — same track
- Third-party penetration testing — available per engagement
- SAML-based SSO — enterprise roadmap
- MFA enforcement at app level — enterprise roadmap
- Multi-region deployment — planned
- Staging environment — planned
- Formal DR drill testing — scheduled
Core Documents
System Architecture
Platform architecture, data flows, trust boundaries, encryption zones, and tenant isolation boundaries.
Access Controls
Authentication methods, role hierarchy, organization membership, API key management, and 3-layer authorization gates.
Data Handling Policy
What data we collect, store, and delete across every product surface. Retention periods and encryption details.
Data Processing Agreement
GDPR Article 28 compliant DPA. Definitions, scope, sub-processor management, SCCs, and termination terms.
Subprocessors
Complete list of third-party service providers. 9 subprocessors across infrastructure, payment, email, and security.
Incident Response Plan
Severity classification, 6-phase response process, customer notification, and regulatory obligations.
Additional Resources
Security Practices
Technical security controls detail
Compliance Matrix
Cross-framework control mapping
Change Management
SDLC, CI/CD, code review
Business Continuity
BCP/DR, RTO/RPO, backup strategy
Vulnerability Disclosure
Responsible disclosure policy
Privacy Policy
Data collection and usage
Terms of Service
Service terms and conditions
SLA
Service level agreement
Questions?
Our security team is available to answer detailed questions about our infrastructure, compliance posture, and security practices.