Legal

Security practices

The controls behind the tenant isolation, audit and backup guarantees described on our home page.

What it will cover

• Tenant isolation: how access is scoped to a tenant on every request, and what the platform administration console can reach.
• Authentication and access control — administrator roles, mandatory second factor for privileged accounts, and lockout on repeated failures.
• The append-only audit log: which actions are recorded, and why the log has no update or delete path.
• Soft deletion, and how a removed record is restored.
• Encryption in transit and at rest, including backups.
• Backup and recovery: continuous replication, retention window, and how restores are rehearsed.
• Hosting and physical security, and the region data is served and backed up in.
• Vulnerability handling and how to report one to us responsibly.
• Sub-processors with access to production, and how that access is reviewed.

← Back to the home page