Security
Security is built into our infrastructure, our software delivery, and our operations. Here's how we protect customer data across each domain.
Data protection & encryption
Customer data is encrypted in transit and at rest.
- TLS 1.2+ enforced at the edge on all customer-facing endpoints
- Encryption at rest for databases and object storage
- Secrets held in a managed secret store with scoped access and rotation
Access control & authentication
Identity-aware access with least privilege.
- Identity-aware API gateway with per-service token audiences
- Multi-factor authentication and single sign-on for internal access
- Least-privilege roles; access is reviewed and revoked on offboarding
Application security
Security is built into how we ship software.
- Static analysis (SAST) and dependency scanning as blocking CI gates
- Server-side upload validation and output sanitization
- Peer-reviewed changes with a secure-by-default deployment pipeline
Infrastructure & network
Hardened, segmented cloud infrastructure.
- Per-environment isolation across development, staging, and production
- Managed WAF and DDoS protection at the edge
- Infrastructure-as-code with misconfiguration scanning in CI
Monitoring, logging & response
We can see and respond to what happens in our systems.
- Centralized, retention-controlled security-audit logging
- Alerting on authentication anomalies and isolation regressions
- A documented incident-response process
Vulnerability management
We find and fix issues continuously.
- Automated dependency updates with a supply-chain cooldown
- Container and filesystem vulnerability scanning
- A public vulnerability-disclosure channel with safe harbor