Security

Audits & Certifications

Our datacenters maintain ISO27001, SOC 1 Type II, and PCI compliance among other industry-standard certifications.

You can request our full security kit toward the bottom of this page.

US/EU Datacenters

Your data is isolated in either our European (Amsterdam) or United States (Virginia) datacenter, based on where you sign up. We never transmit or store data outside of the European Union or United States, respectively.

Dedicated Servers

We lease our own dedicated (iron) servers. We don't use any cloud or shared hosting across our platform.

Data Security

We send data over HTTPS (an encrypted channel) to our platform and allow you to disable tracking of keystrokes in all form fields, disable keystrokes in specific form fields, and exclude/replace content shown in your HTML.

We also salt and hash passwords (using pbkdf2) and offer two-factor authentication.

Physical Security

We take extreme precautions to safeguard our platform. This includes the following measures:

CCTV cameras inside and out
Zoned-access control key card system with secure turnstiles
Access list
Visitors escorted at all times within the building
Intrusion detection systems
Security guards on-site 24/7
Security patrol of complete business site
Perimeter electric fencing
Secured loading dock
Complete location above sea level
VESDA fire detection
Gas based fire suppression
Outside of flight paths
Constant monitoring of security systems and alarms 24/7/365

Monitoring & Testing

We use internal and third-party systems to monitor the confidentiality, integrity, and availability of our platform. If an incident occurs, a team of engineers is alerted immediately. And, if needed, we'll alert you (the client) without delay.

We conduct routine vulnerability scans, penetration tests, and ensure our development efforts follow industry-standard guidelines/best practices.

Policies & Procedures

We follow formal documents to ensure consistency and reliability in our security. This includes requiring all employees to abide by our information security policy, insisting on SLAs (where possible), and maintaining a formal business continuity/disaster recovery plan.