Security,by default.

• +In transit — TLS 1.2+ everywhere; TLS 1.3 preferred. HTTP is redirected, HSTS is enforced, and API endpoints reject plaintext.
• +At rest — AES-256 for all databases, object storage, and backups. Volumes are encrypted at the infrastructure level and application-level field encryption protects credential material.
• +Secrets — API keys are stored hashed; we can verify them but never read them back. Third-party OAuth tokens are encrypted with a dedicated key hierarchy.

Internally, production access follows least privilege with hardware-key MFA, just-in-time elevation, and full audit logging. No standing production database access exists for any engineer.

For your workspace: role-based access (owner, admin, member), per-key API scopes, workspace-level SSO on Enterprise, and complete audit trails for merges, exports, and deletions.

• +Every change passes code review and automated security scanning (dependencies, secrets, static analysis) before merge.
• +Staging environments use synthetic data only — customer data never leaves production.
• +Matching-model updates are evaluated against a frozen benchmark set before rollout; regressions block deploys automatically.
• +Dependencies are pinned, scanned daily, and patched on a severity-based schedule: critical within 72 hours.

We run a documented incident process: detect, contain, eradicate, recover, review. Every incident gets a blameless postmortem; material ones get a customer-facing summary.

If a breach affects your workspace data, we notify affected workspace owners without undue delay and within 72 hours where GDPR applies — with what happened, what was affected, and what we are doing about it.