Security & Compliance

All data encrypted at rest (AES-256) and in transit (TLS 1.3). API keys are hashed with bcrypt. No plaintext secrets ever stored.

Role-based access control with principle of least privilege. API key scoping, IP allowlisting, and SSO/SAML support for Enterprise.

Regional data isolation ensures your visitor data stays in your chosen region (EU or US). Data is never shared with third parties.

Comprehensive audit trail for all API access, configuration changes, and administrative actions. Exportable logs for compliance review.

Around-the-clock monitoring with automated alerting. Documented incident response playbooks with clear severity tiers and escalation paths.

Regular third-party penetration testing and vulnerability assessments. Responsible disclosure program for external security researchers.