Trust center
Security, stated plainly
No badge-wall theater: live controls are marked, in-flight certifications are dated. Ask for anything missing — [email protected].
| SOC 2 Type II | In audit — report Q1 2027 | Roadmap |
| HIPAA | Roadmap — BAA with Enterprise VPC | Roadmap |
| Secrets at rest | AES-256-GCM (when a secrets key is configured) | Live |
| API keys at rest | SHA-256 hash only — secrets never stored | Live |
| Sessions | httpOnly, SameSite=Lax, 30-day TTL | Live |
| Audit log | Recent security events (rolling window) | Live |
| Pen tests | Annual third-party + continuous internal | Roadmap |
| Data residency | GLOBAL / US / EU / APAC — best-effort region preference during beta | Live |