Trust
Independent audits, documented controls, and evidence you can hand straight to procurement.
SOC 2 Type II
Audited through Nov 2025 by Prescott LLP
ISO/IEC 27001
Certificate 44-2211, valid to 2027
GDPR
DPA and SCCs available on request
HIPAA
BAA signed on Scale and Enterprise
Encryption everywhere. AES-256 at rest, TLS 1.3 in transit, no exceptions for internal traffic.
SSO and SCIM. SAML with enforced provisioning and automatic deprovisioning on offboarding.
Key rotation. Customer-managed keys with a 90-day rotation schedule you control.
Penetration testing. Twice yearly by an external firm; summaries published in the trust centre.
Data residency. Pin your workspace to the EU, US or AU region at creation time.
Backups and recovery. Point-in-time restore to any minute in the last 35 days, tested quarterly.
Everything above is documented, dated and downloadable — most teams clear review in a single call.