Customer Trust Center

Security is built into our product at every stage, from design and development through deployment and ongoing operations. We follow a secure software development lifecycle (SDLC) that incorporates threat modeling, peer code review, and automated security testing, and we continuously monitor for and remediate vulnerabilities, supported by regular third-party penetration testing. Customer data is encrypted both in transit and at rest. Access is governed by enterprise-grade controls, including role-based access control (RBAC) and multi-factor authentication (MFA), with Single Sign-On (SSO) available for supported services, so you can align product usage with your organization's policies.

The organization maintains a data security program aligned with recognized industry standards and regulatory frameworks to protect customer data throughout its lifecycle. Controls are in place governing data classification, encryption in transit and at rest, access management, vulnerability management, and security monitoring. A formal incident response plan governs how security events are escalated, contained, and communicated to affected customers. Vendors with access to customer data are assessed prior to onboarding and held to contractual data protection obligations, and all personnel with data access receive recurring security awareness training.

Application security is a core component of our security program, applying controls across the full software development lifecycle. Secure coding standards and design principles are incorporated into development practices, and code changes are subject to review processes prior to deployment. We conduct regular application vulnerability assessments, including static and dynamic analysis and penetration testing, with findings tracked and remediated within defined timeframes. Access to application environments is restricted based on role and business need, and changes to production systems follow a formal change management process. Security considerations are evaluated when introducing new applications or making significant changes to existing ones.

The organization treats AI adoption as a governed activity, recognizing that the use of AI introduces distinct operational, security, and ethical considerations. We maintain policies and oversight processes for the evaluation, approval, and use of AI tools and capabilities within our environment, including employee-facing tools, third-party AI integrations, and AI-assisted workflows. Controls are applied to address risks related to data privacy, model integrity, unintended outputs, and access to sensitive information. AI use cases involving customer data are subject to additional review to ensure appropriate safeguards are in place. We continue to evolve our AI governance practices in alignment with emerging standards and regulatory expectations.

Environmental, social, and governance considerations are incorporated into our operations and decision-making processes where relevant to our business and stakeholders. On the environmental side, we are mindful of our operational footprint and look for practical opportunities to reduce waste and resource consumption. Socially, we are committed to maintaining a diverse, equitable, and inclusive workplace, supporting employee wellbeing, and engaging responsibly with the communities in which we operate. From a governance perspective, policies and oversight structures are in place to promote ethical conduct, accountability, and transparency across the business. Our ESG practices are guided by our organizational values and informed by applicable expectations from regulators, customers, and other stakeholders.

Customer privacy is a core consideration in how we design and operate our services. Privacy practices are informed by recognized industry guidance and aligned with applicable privacy laws and regulations across the jurisdictions relevant to our processing activities. Personal data is collected and processed only for defined, legitimate purposes, and retained no longer than necessary. Individuals whose data we process are afforded rights consistent with applicable law, and processes are in place to respond to those requests in a timely manner. Privacy considerations are incorporated into the evaluation of new products, services, and vendors that involve the handling of personal data. Incidents involving personal data are managed in accordance with our incident response procedures and applicable breach notification requirements.

Access to systems, applications, and data is granted based on business needs and managed through defined authorization practices, including role-based access controls and the principle of least privilege. Multi-factor authentication is required for access to sensitive systems and environments. Access rights are reviewed on a recurring basis and adjusted promptly when roles or responsibilities change, including upon employee departure. Privileged access is subject to additional controls and logging to support accountability and auditability. Access provisioning and deprovisioning follow documented processes to reduce the risk of unauthorized or inappropriate access.

Infrastructure is sourced from established cloud and hosting service providers selected and managed in accordance with our vendor management and security practices, with attention to security, availability, and operational resilience. Provider security capabilities, including physical security, environmental controls, and platform-level protections, are evaluated as part of the selection process and monitored on an ongoing basis. Controls applied at the infrastructure level include network segmentation, logging and monitoring, vulnerability management, and configuration hardening aligned with recognized benchmarks. Resilience and recovery capabilities are maintained to support continuity of services in the event of disruption.

Company-managed devices used to access business systems and data are subject to endpoint security controls aligned with recognized industry guidance and internal security policies. Controls include endpoint protection software, device configuration standards, encryption of data at rest, and management through a centralized device management platform. Endpoints are monitored for threats and policy compliance, and software patching is applied on a defined schedule to address known vulnerabilities. Use of unmanaged or personal devices to access sensitive systems is governed by policy, and access from such devices is subject to additional controls where permitted.

Network security controls are implemented to safeguard our environment from external and internal threats, including unauthorized access and common network-based attacks. Controls include network segmentation, firewalls, and traffic filtering to restrict access to sensitive systems and limit lateral movement. Remote access to internal systems is secured through encrypted connections and requires authentication consistent with our access control standards. Network activity is monitored and logged to support threat detection, investigation, and response. Network security configurations are reviewed and updated on a regular basis in alignment with our security architecture and risk management practices.

Internal security measures and operating practices are maintained to support consistent security posture across the organization. This includes security policies and standards that govern employee behavior and expectations, background screening for personnel in relevant roles, and recurring security awareness training to reinforce responsible practices. Physical access to office locations and sensitive areas is controlled and monitored. Security risks are assessed on an ongoing basis, and controls are reviewed and updated to reflect changes in the threat landscape and business environment. Security responsibilities are assigned across the organization to support accountability and program continuity.

Ongoing monitoring of our public-facing security posture is performed as part of our broader security program. Independent security grades, where issued and approved for publication, are posted here to provide additional transparency into our security performance. These grades reflect an external perspective on observable security signals and complement our internal security controls and assessment activities.

Defined incident response procedures are maintained and supported by designated personnel responsible for coordinating the detection, assessment, containment, and remediation of security incidents. Incidents are classified by severity to ensure appropriate prioritization and escalation. Internal communications and stakeholder notifications follow documented processes aligned with our policies and applicable regulatory and contractual obligations. Post-incident reviews are conducted to identify root causes and drive improvements to our controls and response capabilities. The incident response program is tested and updated on a regular basis to reflect changes in the threat environment and organizational structure.

A security risk management program is maintained to support the identification, assessment, treatment, and ongoing monitoring of risks relevant to our information systems and service delivery. Risks are evaluated in the context of business impact and likelihood, and treatment decisions are documented and tracked to resolution. Designated personnel with defined roles and responsibilities oversee program execution and ensure risks are reviewed on a recurring basis or when material changes occur. Risk management activities inform the prioritization of security investments and control improvements across the organization.

Asset management practices are maintained to provide visibility over material information technology assets across their lifecycle, from procurement and deployment through retirement and disposal. Assets are inventoried and classified based on their function and the sensitivity of data they process or store, with ownership assigned to support accountability. Safeguards are applied commensurate with asset classification, and decommissioned assets containing sensitive data are disposed of in accordance with documented procedures. Asset management practices are governed by defined policies and subject to periodic review.

Business continuity and disaster recovery plans are maintained to support the resilience of critical operations and service delivery in the event of significant disruptions. Recovery objectives are defined for critical systems and processes, and plans are designed to meet those targets through documented procedures, designated personnel, and recovery capabilities. Plans are reviewed and tested on a periodic basis to validate their effectiveness and reflect changes in the business environment. Lessons learned from tests and actual events are used to drive improvements to continuity and recovery capabilities.

Security awareness training is delivered to employees and, where applicable, relevant contractors and other personnel in accordance with internal policies. Training is provided upon onboarding and repeated on a recurring basis to reinforce expected behaviors, security responsibilities, and controls aligned with recognized practices for our environment. Content is updated to reflect changes in the threat landscape, organizational policies, and applicable regulatory expectations. Role-specific training is provided to personnel with elevated access or security responsibilities to address the risks relevant to their functions.

Change and configuration management processes are maintained to ensure that modifications to production systems and related configurations are subject to appropriate review, testing, and approval prior to implementation. Changes are categorized by type and risk level to determine the required level of oversight, and segregation of duties controls are applied to reduce the risk of unauthorized or unintended changes. Emergency change procedures are defined for time-sensitive situations and subject to post-implementation review. Change activity is logged and available for audit purposes.

Physical and environmental protections for systems supporting our services are primarily implemented through controls maintained by our infrastructure providers, consistent with shared responsibility models applicable to cloud and hosted environments. Provider controls, including physical access restrictions, environmental monitoring, and facility security, are evaluated as part of our vendor management and security oversight processes. Where applicable, internal physical security requirements complement provider controls to address risks associated with our own office locations and any on-premises assets. Access to physical office environments is controlled and monitored in accordance with internal policies.

Ongoing monitoring capabilities are maintained across in-scope systems to support the detection of security events, anomalous activity, and potential vulnerabilities in a timely manner. Monitoring tools and processes cover key areas including network traffic, system and application logs, endpoint activity, and access patterns. Alerts are tuned to reduce noise and surface meaningful signals, and monitoring outputs are integrated with defined escalation and incident response procedures. Monitoring coverage and configurations are reviewed on a regular basis to reflect changes in the environment and evolving threat conditions.