Trust Center
Every standard we meet, every control in place, and what we do not claim, on one page a compliance officer can read without asking us for anything. Ten standards, verified against the site.
Verified Against The Site Limits Stated No Questionnaire Needed
Checked Against The Running Site
Ten standards confirmed on this deployment, not copied from a provider page.
Every Subprocessor Named
Nine of them, with what each one handles and where it runs.
What We Do Not Claim
Six limits stated outright, including no SOC 2 report and no ISO 27001.
What Is True Today
Verified against the running site, not copied from a provider's marketing page.
Checked October 10, 2026
TLS 1.3 Encryption
TLS 1.1 RefusedEvery connection encrypted. Older protocols refused outright.
HSTS Enforced
max-age One YearA browser that has been here once will never use plain HTTP.
PCI DSS Level 1
Via StripeNo card number reaches our servers, our logs or our database.
GDPR And UK GDPR
DPA PublishedWe are your processor. Addendum and clauses are published.
CCPA And CPRA
No Sale Of DataWe never sell data. Ad cookies are yours to switch off.
TCPA And CTIA
Consent On RecordConsent is on record, and STOP is handled by the platform.
CAN-SPAM
One-Click Opt-OutEvery campaign carries an opt-out that takes effect at once.
Email Authentication
DMARC QuarantineSPF, DKIM and DMARC all published, with DMARC on quarantine.
A2P 10DLC Registered
Carrier ApprovedNo account can text until its carrier registration clears.
Global Privacy Control
Honored Site WideA browser opt-out signal is acted on before we ask you.
Answers To The Questionnaire
The controls in place, every provider that touches your data, and the documents behind them.
Workspace Isolation
Scoped At The Query Layer
Credentials At Rest
Encrypted, Never Plain Text
Transport
TLS 1.2 And 1.3 Only
Password Policy
Ten Characters, Mixed
Two-Factor Login
TOTP, Per User
Session Cookies
Secure, HttpOnly, SameSite
Content Security Policy
Objects And Forms Locked
Clickjacking
Framing Blocked Site Wide
Rate Limiting
Per Route And Per API Key
Admin Audit Trail
Actor, Time, Before, After
Login Events
Recorded, Pruned Nightly
Bot Defense
reCAPTCHA On Public Forms
OPVII
Application And Database Hosting
ReceivesAll Platform Data
Location United States
Cloudflare
DNS, CDN, Firewall, Inbound Mail Routing
ReceivesRequest Metadata, Traffic In Transit
Location Global Edge, United States Origin
Stripe
Subscription Billing
ReceivesBilling Contact, Card Token
Location United States
Twilio SendGrid
Transactional And Campaign Email
ReceivesRecipient Email, Name, Message Body
Location United States
Amazon SES
Email Delivery
ReceivesRecipient Email, Name, Message Body
Location United States
Twilio
SMS Delivery
ReceivesRecipient Number, Message Body
Location United States
SignalWire
SMS Delivery And Inbound Replies
ReceivesRecipient Number, Message Body
Location United States
AWS End User Messaging
SMS Delivery
ReceivesRecipient Number, Message Body
Location United States
Marketing Site Analytics And Ad Measurement
ReceivesPseudonymized Site Usage, Marketing Pages Only
Location Global
Certifications shown belong to that provider and are not ours. If a provider is not listed, it does not process data on your behalf. The full register is at Subprocessors.
Automated Test Suite
Runs On Every Change
Third-Party Pen Test
Not Commissioned Yet
Arrowed rows open a third-party checker we do not control, so you read their result, not our claim. None of it is a penetration test.
What We Do Not Claim
Each gap is under active review. If one blocks your procurement, say so early and we will answer plainly rather than let you find out at onboarding.
No SOC 2 Report
Reviewing OptionsNo Type I or Type II examination, and we claim neither.
No ISO 27001
Reviewing OptionsNo ISO 27001 or 27701 certificate exists for the platform.
No HIPAA Agreement
Reviewing OptionsWe sign no BAA. Do not load protected health information.
Scoped Encryption
Reviewing OptionsCredentials are encrypted at rest. Contact fields are not.
Admin-Only Audit Log
Reviewing OptionsAdmin actions are recorded. Record views are not logged.
No Pen Test Report
Reviewing OptionsNo third-party test yet. See Testing for what we do run.
Vendor Review Or A Report
Due Diligence And Vendor Review
Send the questionnaire and we will complete it, including the questions where the honest answer is no. A countersigned Addendum, the Standard Contractual Clauses and the provider register need no call.
Email Our TeamReporting A Vulnerability
Write with enough detail to reproduce it. We will acknowledge, keep you updated, and will not pursue action against good-faith research that avoids privacy violations, service degradation and data that is not yours.
Report An Issue