Trust center
Use this page during procurement and security reviews. It centralizes technical controls, operational practices, and ownership boundaries that enterprise buyers request.
Security review artifacts
| Artifact | Status | How to request |
|---|---|---|
| Security questionnaire support | Available | [email protected] |
| Subprocessor disclosures | Documented in privacy configuration and trust docs | Security & privacy |
| Operational readiness posture | Published | Operations guide |
Security controls
- TLS-only production posture with HSTS and strict security headers.
- Workspace authorization policies across UI and API routes.
- Token-based API access with workspace-scoped Sanctum abilities.
- Queue isolation for ingestion and analytics workloads.
Identity and access
Enterprise identity routing supports domain-based SSO entrypoints and workspace-level SSO enforcement controls. Google OAuth is available today where configured, and SAML/OIDC adapter architecture is prepared for phased rollout.
We are especially committed to Google Workspace and Microsoft 365 customers: we document rollout patterns for both ecosystems, align with directory-aware sign-in where you enable it, and prioritize support questions from Workspace and Microsoft 365 administrators alongside your marketing stakeholders.
Auditability
Workspace audit log includes authentication and administration events, with filterable views and CSV export for enterprise tiers.
Data protection controls
Controls a workspace can turn on for itself, rather than platform defaults it has to accept.
| Control | Default | What it does |
|---|---|---|
| Per-workspace scan retention | Platform window | A workspace may set a shorter window than the platform default and have it enforced by the daily purge. It may not set a longer one: that is our obligation to the people whose visits are recorded, and a customer cannot waive it on their behalf. |
| Visitor IP anonymisation | Off | Truncates each visitor IP to its network (IPv4 /24, IPv6 /48) before the analytics job is even queued, so the full address reaches neither the queue nor the database, and appears in no backup of either. Country and region reporting are unaffected; per-address precision is the cost. |
| Tamper-evident audit log | Always on | Each entry commits to the previous entry, keyed with the application key, so an edited, deleted or inserted row breaks the chain. Verified on a daily schedule rather than only when someone thinks to look. |
| Session bounds | Off | Separate idle timeout and absolute session lifetime. The absolute bound is what limits a compromised session that is kept deliberately warm. |
| SCIM 2.0 deprovisioning | Available | Removing someone in your directory removes their workspace access immediately, whether your provider deletes them or marks them inactive. |
| SAML 2.0 and OpenID Connect | Available | Federate with your own identity provider over either protocol. Assertions are verified against your signing certificate; anything unsigned, expired, addressed to another service provider, or already used is refused. Managed under Settings → Single sign-on. |
| Verified SSO domains | Required | Your identity provider can only sign in people whose email is at a domain you have proved you control with a DNS TXT record. A domain can be federated by one workspace only, and we re-check hourly — a claim whose record disappears is revoked. Managed under Settings → Single sign-on. |
Business continuity
Recovery objectives, backup scope and the ordered restore procedure are published rather than summarised. See the disaster recovery runbook.
Data retention and privacy
Retention windows, purge jobs, and subprocessor disclosures are managed in configuration and surfaced in docs. Review Security & privacy for current defaults.
Operational readiness
Runtime checks are available via platform:readiness-check and are scheduled in production to detect dependency drift (Redis/Imagick/queue connectivity).