See how we protect your data and where we are with each compliance program. We update this page as each milestone is reached.
All three are in progress. We'll only claim certification once the work is done and independently audited.
An independent audit of how we protect customer data over time, against the AICPA Trust Services Criteria for security[, availability and confidentiality].
For healthcare customers in the United States: aligning our safeguards with the HIPAA Security Rule so we can sign Business Associate Agreements (BAAs) and handle protected health information on AWS HIPAA-eligible services.
For customers with users in the EU and UK: extending our privacy program to meet GDPR requirements alongside our Asia-Pacific obligations.
Data is encrypted in transit (TLS) and at rest, using AWS Key Management Service.
Least-privilege access, single sign-on and multi-factor authentication for every team member.
Centralised logging and threat detection across our AWS accounts, with alerts to our team.
Customer data is hosted on AWS in the Asia Pacific (Singapore) region by default.
Background checks where lawful, confidentiality agreements and annual security training.
A documented response plan, with customers notified promptly if their data is affected.
Yes. Request our security pack and we'll share our policies, architecture overview and current compliance status under NDA.
Yes — send it with your security pack request and we'll return it, usually within 5 business days.
We're targeting Q2 2027. Ask us to notify you when it's ready.
Email [email protected]. We'll acknowledge reports within 2 business days.