Marketing content is managed inside the platform by a platform administrator, and publishing is gated: a statistic cannot go live without a source and a measurement date, a client cannot be named without a consent reference on file, and a testimonial needs an attributed person and organization. Client logos are self-hosted with permission recorded against each one — never loaded from a third-party origin. Every publish, rollback and withdrawal is written to the same audit log as everything else.
Trust & security
Built to pass your security review.
We handle the most sensitive signal an organization has — how its people respond to attack. This page describes, plainly, how that data is protected. Every statement here reflects how the system actually works; if your security team wants to go deeper on any of it, talk to us and we will walk through the specifics.
You will not find a compliance badge on this page. We do not hold an attestation yet, and displaying one we had not earned would tell you nothing true about the platform.
The platform is multi-tenant with hard boundaries. Every record is scoped to its organization, and a dedicated guard layer audits and enforces organization scoping on database queries at runtime. Public, unauthenticated endpoints serve platform-level aggregate figures only — never anything derived from tenant data. A federated sign-in asserting an identity from another tenant is denied outright.
Password sign-ins are protected by multi-factor authentication with one-time codes and account lockout on repeated failure. Organizations can bring their own identity provider via per-tenant SAML single sign-on: assertions must be signed by the tenant’s registered certificate, replay is rejected, and the browser handoff uses short-lived single-use codes so session tokens never appear in URLs. MFA challenge data likewise never travels in URLs.
User passwords are stored only as adaptive one-way hashes. Integration API keys are org-scoped, shown once at creation, stored as SHA-256 hashes, and individually revocable. The breach-exposure monitoring module is built around a strict redaction boundary: recovered credential values from breach or infostealer corpora are read only to set exposure flags and are never written to our systems — only field names survive ingestion.
All traffic is encrypted in transit. The platform accepts TLS 1.2 and 1.3 only, with a restricted modern cipher suite, and sends HTTP Strict Transport Security with a long max-age. Standard hardening headers (content-type sniffing protection, referrer policy, frame protections) are served platform-wide.
Security-relevant events are recorded in an audit log: sign-ins and failures (including the authentication method, so SSO logins are attributable), administrative changes, MFA challenges, and authorization denials. The log is hash-chained, so altering or deleting any record breaks every hash after it. Email deliveries are logged with outcome. Audit data is available to your administrators for review and export.
Authentication and public endpoints are rate-limited per source. Account-recovery endpoints return the same response whether or not an account exists, preventing account enumeration. The public contact and demo forms combine rate limiting with honeypot detection. Uploaded media has its type decided from its content rather than its filename, and embedded metadata is stripped before anything is stored.
Deployments are containerized with the database isolated from public exposure. Changes ship with tagged rollback images so any release can be reverted in minutes. Security review is part of feature work — capabilities that touch authentication or tenant boundaries are tested adversarially before they are enabled for customers, and route-level authorization coverage is enforced by a test that fails the build when a new endpoint has no guard.
If you believe you have found a security issue, we want to hear about it. Use the contact form or your account manager, and we will acknowledge your report promptly and keep you informed as we investigate. We ask that you avoid accessing other tenants' data while testing.
Platform availability is public. We would rather you check it than ask us.