Trust
A security company should be easy to check.
Here's how we protect the platform and your data, and exactly where we stand on compliance.
How we secure the platform
Strict tenant isolation
Every query is scoped to your organization. One customer’s data is never reachable from another customer’s session.
Untrusted code never runs in our app
Connecting to an unknown MCP server only happens inside a disposable, hardened container with no network and a read-only filesystem.
Keys are hashed and shown once
We store only a hash of each API key. The key itself is shown once, so a leaked database holds no usable credential.
Encrypted in transit and at rest
All traffic uses TLS, and data is stored in managed PostgreSQL with encryption at rest.
Access control built in
Role-based permissions enforced on the server, two-factor login, and SAML SSO with SCIM provisioning for enterprise teams.
Audit trail
Approvals, policy changes, key issuance, and member changes are written to an append-only log you can export.
How we handle your data
Your data never trains a model
Nothing you send us is used to train or fine-tune any model, and we never sell or share it.
AI analysis is optional
AI-assisted analysis is off until you turn it on. When on, it runs on Anthropic’s commercial API terms, which carry no training rights.
We keep only what we need
Findings are stripped of raw content and secrets are redacted before anything is saved.
You control retention
Scan history stays until you delete it or close your account. Export and erasure are self-serve for your admins.
Compliance
We say what's done and what isn't. Nothing here is claimed before it's real.
| Framework | Status | Details |
|---|---|---|
| SOC 2 Type I | In preparation | Controls documented, report in preparation. Not yet audited. |
| SOC 2 Type II | Planned | Follows Type I. Timeline shared on request. |
| ISO/IEC 27001 | Planned | On the roadmap. |
| GDPR | Aligned | Data-processing practices aligned. DPA available on request. |
Subprocessors
| Provider | Purpose |
|---|---|
| Microsoft Azure | Application hosting and managed PostgreSQL, encrypted at rest |
| AWS Bedrock / Anthropic | AI analysis, only when AI analysis is turned on |
| Transactional email provider | Account, invite, and notification emails |
Responsible disclosure
Found a security issue? Email us with details and steps to reproduce. We'll respond promptly and keep you updated through the fix. We won't pursue good-faith research that respects our users' data and avoids disruption.
Report an issue