Compliance
What exists today, what a report would add, and when we will pursue one. Written so a security review can quote it instead of emailing us.
In short
- No SOC 2, HIPAA or PCI attestation today — this page is the honest substitute until there is one.
- What exists: EU residency, encryption of every secret at rest, RBAC with an audit log, verified inbound sources, and a tested SSRF guard.
- SOC 2 is committed when a customer contract requires it; the controls below are built to make that audit short.
What exists today, verifiable in the product
| Control | Status |
|---|---|
| Data residency | EU (Frankfurt) only. There is no other region to misconfigure |
| Secrets at rest | Endpoint secrets, destination credentials, mTLS keys — all encrypted with a server key; no plaintext column exists |
| Access control | Four roles, per-organisation, enforced server-side on every route |
| Audit log | Operator actions recorded with actor, action and parameters hash |
| Egress safety | Two independent layers against reaching private networks, covered by a dedicated test suite |
| Inbound verification | Fifteen providers verified against their own signatures before anything enters the pipeline |
| Delivery signing | Standard Webhooks over the exact bytes delivered, with overlapping secret rotation |
| Portal exposure | Consumer portal links are scoped, expiring, signed grants — no accounts, no passwords to breach |
What a report would add, and our position
| Item | Position |
|---|---|
| SOC 2 Type II | Committed when a customer contract requires it. The controls above are maintained audit-shaped so the observation window is the long pole, not remediation |
| HIPAA / PCI-DSS | Not pursued: health and card data are not what this product should carry. The payload guard and archival exist for operational data |
| DPA | Available on request for paid plans |
| Subprocessors | An EU cloud infrastructure provider (Frankfurt), an object-storage provider for archived payloads, an email delivery provider for operational mail, and a managed Postgres provider. Named in the DPA |
Why publish this instead of waiting for the badge. A report attests yesterday's controls; the table above is checkable today. If a comparison page led you here expecting a certificate we do not have — that comparison page told you the truth, which is also how the rest of it was written.