Trust Centre
How we protect your data, what we can evidence, and what we are still working on. Written for the person whose job it is to check.
Last updated: 25 July 2026
Where we actually stand
We are not SOC 2 audited, and we do not claim to be. We have built and documented the controls an audit would examine, and we run them, but no independent auditor has attested to them. We would rather tell you that than display a badge we have not earned. If a SOC 2 report is a hard requirement for your organisation, tell us and we will discuss timelines rather than pretend.
The platform is not intended for protected health information, and we do not sign Business Associate Agreements. Please do not put clinical or medical records into coaching conversations or assessments.
Two things we know are open. We have not yet performed a live restore test of our database backups, backups run with point-in-time recovery, but the restore has not been exercised end to end. And session revocation is held per-instance rather than in shared storage, which is low risk while we run a single instance and is on the list to change before we scale out.
Controls we operate
Encryption
- TLS enforced on all traffic; plain HTTP redirects to HTTPS
- Database encrypted at rest by our hosting provider
- Object storage encrypted at rest by default
- Sensitive fields, including email addresses in audit logs, masked before storage
Access control
- Production database and infrastructure access restricted to the founder
- Multi-factor authentication required on every administrative account, without exception
- Role-based permissions with differentiated admin roles, no blanket access
- Access reviewed at least every six months; removal within 24 hours when no longer needed
- API keys scoped to the minimum permissions required
Monitoring and audit
- Security-relevant actions written to an append-only audit log, retained 365 days
- Server exceptions captured with personal data scrubbed
- Every outbound email and SMS logged
- Automated weekly dependency vulnerability scanning
- Security violations raise an alert, not just a log line
Tenant isolation
- Member data scoped by owner on every read; verified by automated tests
- Cross-organisation and cross-member isolation covered by end-to-end journey tests
- Account suspension revokes sessions immediately across all replicas
Change management
- No direct commits to production; every change passes lint, typecheck and the test suite
- Changed code without a covering test fails the build
- Database migrations are idempotent and run automatically at boot
Backup and recovery
- Managed PostgreSQL backups with point-in-time recovery
- Recovery Time Objective 4 hours; Recovery Point Objective 24 hours
- Media assets recoverable from source
Vendor management
- Every processor evaluated before use and bound by a written data-protection agreement
- Full processor list published, with 30 days' notice before any addition
- New vendors handling personal data require explicit approval before receiving live data
Privacy by design
- Members can export all their own data, and delete their account permanently, without asking us
- Consent is recorded with the policy version, timestamp and IP at the moment it is given
- Rater feedback is withheld below a three-response threshold so individuals cannot be identified
- Uploaded documents are processed in memory and never written to our database or storage
Policies we maintain
Information Security Policy
Access control, encryption, secrets handling, secure development, vendor management, backup and recovery.
Incident Response Plan
Severity levels with response times, notification paths, and the 72-hour regulator commitment.
Risk Assessment
Twelve identified risks scored by likelihood and impact, with mitigations and accepted residual risk.
Threat Model
Trust boundaries across the public client, member sessions, back-office access, the database and third-party services.
Data Processing Agreement
Available to organisation customers on request.
Organisation customers can request any of these, along with our Data Processing Agreement, at [email protected].
Sub-processors
Every third party that processes personal data on our behalf is listed publicly, with what it receives and where it processes it, including our AI providers and their individual positions on model training.
View the full sub-processor list →Reporting a security issue
Email [email protected], or see /.well-known/security.txt. We will not pursue action against good-faith researchers who report privately and allow reasonable time to remediate.
Frequently asked questions
See also our Privacy Policy and Terms.