Documentation, certifications, and policies all in one place.

Our SOC 2 Type II report is available to current customers, prospects under active evaluation, and partners under a standard mutual NDA. To request a copy, please contact our team. We'll typically share documentation within one business day.

Our standard DPA is built on the GDPR Article 28 requirements and incorporates the EU Standard Contractual Clauses (SCCs) for international data transfers. The DPA is auto-attached to every paid plan agreement. Custom DPAs and additional SCCs can be negotiated on the Scale plan.

We use a small number of carefully vetted subprocessors to deliver the platform — primarily Google Cloud Platform and Amazon Web Services for infrastructure, plus Stripe for billing, SendGrid for transactional email, and Anthropic + OpenAI for AI model inference (with zero-retention agreements that prevent any of your data from being used for model training). Our complete, current list of subprocessors is available on request and is updated whenever we add or remove a vendor.

For a complete walkthrough of our security architecture — encryption, access control, infrastructure, incident response, and disaster recovery — see our security page. For deeper architectural diagrams or a security questionnaire response, please get in touch.

We welcome responsible disclosure of security vulnerabilities. Please email [email protected] with a description of the issue and any reproduction steps. We acknowledge all reports within 24 hours and follow industry-standard coordinated disclosure timelines.