Trust
Said plainly, written down.
We are a small team. We have not pursued formal certification yet. Below is how we actually operate. No borrowed credentials, no false comfort.
Where we stand today
What we do, what we do not.
Every action in the platform is recorded in a workspace scoped audit log. Export to CSV or JSON any time. We build first, certify later.
Questions
The honest kind.
Are you SOC 2 certified?+
No, not yet. We are a small team and the audit process is expensive for our stage. We answer security questionnaires directly and we will tell you what we do and do not have.
Are you GDPR compliant?+
We follow the practices GDPR asks for - data minimization, scoped access, deletion on request, transparent sub processors - but we do not claim a certification we do not hold. Write to us for specifics.
Can I get a signed data processing agreement?+
We are happy to review yours. Send a draft to the contact address and we will respond within a few days.
How do you handle an incident?+
We write to every affected customer as soon as we confirm what happened. No template. No hiding behind legal language.