Security
What we have, what we don't, who to ask.
We're a small team. We don't have a 200-person security org. We do have a clear set of controls, a public roadmap to the ones we're working on, and named contacts you can email. If a vendor can't tell you what's in their SOC 2, that's a red flag.
Encryption
In transit
TLS 1.3 on all web traffic. HSTS preloaded. No SSL 3.0, no TLS 1.0, no TLS 1.1.
At rest
AES-256-GCM with per-tenant keys, wrapped by a workspace pepper. See api/src/encryption.ts.
Backups
Daily, encrypted, retained 30 days. Stored in a separate Azure region from production.
Secrets
API keys, OAuth client secrets, and payment processor credentials are in Azure Key Vault. No secret in environment variables in production.
Access
Authentication
OIDC with PKCE. Magic-link and email-password options. TOTP MFA (work in progress — see #NNN).
Authorization
Role-based (Owner, Admin, Manager, Member). Per-workspace. No implicit cross-tenant access — every query is tenant-scoped (api/src/tenantOwnership.ts).
Sessions
15-minute access tokens, 30-day refresh tokens. Refresh tokens rotated on use. Signing keys rotated every 30 days.
OAuth providers
Google and Microsoft (work in progress). SAML SSO on Venue (work in progress).
Audit
Workspace audit log
Every mutation logged with who, what, when, from where. 90-day retention in-product, 7-year cold storage.
Application audit log
Internal: auth events, billing events, integration events. 1-year retention, 7-year cold storage.
Export
Workspace admins can export the audit log to CSV any time.
Retention
GAAP / IRS-compliant: 7 years for billing records, 1 year for application logs, 90 days for access logs.
Data residency
US-only today
All data is stored in Azure East US 2. We do not have an EU region today.
EU on the roadmap
Q4 2026 / Q1 2027. Tenant-level region selection. We'll notify customers 90 days before any region change.
No third-party data sharing
We don't sell data. We don't share data with advertisers. We use a small set of subprocessors (listed below) and that's it.
No training on customer data
We don't train any model — ours or a third party's — on your data. We use a small set of LLMs for product features (e.g., quote drafting) but they process the request and forget.
Subprocessors
The third parties that process customer data. We notify customers 30 days before adding a new one.
| Subprocessor | Purpose | Region |
|---|---|---|
| Microsoft Azure | Hosting (compute, blob storage, SQL) | East US 2 |
| Stripe | Payments and Stripe Connect payouts | US |
| Cisco Meraki | Venue WiFi network APIs (read-only) | US |
| Twilio | SMS (marketing add-on) | US |
| SendGrid | Email (marketing add-on) | US |
| Microsoft ACS | Transactional email + email-to-ticket | US |
| Plausible | Privacy-friendly analytics on marketing site | EU |
| Google Analytics | Marketing site analytics (consent-gated) | US |
Certifications
Where we are, honestly. The list is short because we're a small team.
SOC 2 Type II
in progressTarget Q1 2027. Type I in Q3 2026.
GDPR
compliantData processing agreement, EU SCCs for any EU subprocessor. Right-to-erasure endpoint at /api/gdpr/erasure.
CCPA
compliant"Do not sell" link on marketing site footer. Opt-out endpoint at /api/gdpr/opt-out.
PCI DSS
inheritedWe don't touch card data. Stripe is the merchant of record. PCI scope is Stripe's.
Contacts
Real people, real inboxes. Same-business-day response on weekdays.