Controls
UpdatedService infrastructure maintainedNot yet checked
Remote access MFA enforcedNot yet checked
Remote access encryptedNot yet checked
Employee background checks performedNot yet checked
Security awareness training completedNot yet checked
Production inventory maintainedNot yet checked
Incident response plan testedNot yet checked
Incident response policies establishedNot yet checked
Daily backups with tested restoresNot yet checked
AI system scope definedNot yet checked
Model monitoring and evaluation in placeNot yet checked
Training data provenance documentedNot yet checked
Data encryption utilizedNot yet checked
Vulnerability handling establishedNot yet checked
Privacy policy establishedNot yet checked
Data retention procedures establishedNot yet checked
Data subject procedures establishedNot yet checked
Data collected
Customer personally identifiable informationCollected
Employee personally identifiable informationCollected
Credit card informationNot collected
Personal health informationNot collected
Subprocessors
Google CloudApplication hosting, databases, backups and logsCore product · Canada (Toronto), US (database backups), global (logs)
DigitalOceanLegacy hosting and databases, being decommissionedCore product · Canada, US
CloudflareDNS, content delivery and public document storageCore product · Global edge network
VercelFrontend hostingCore product · US
FAQ
Where is production data hosted?In Google Cloud, in the Toronto region (northamerica-northeast2), where most of our production services and their main database run. That database's daily backups are stored in Google Cloud's United States multi-region. Some older DigitalOcean resources still run and hold data until we finish decommissioning them. Several subprocessors listed on this page, including our sign-in and analytics providers, process data in the United States.
Is data encrypted?Data stored in Google Cloud is encrypted at rest by Google, and our services are reached over HTTPS.
How often are controls tested?Nothing has evaluated the controls on this page yet, so each one reads Not yet checked. This page shows when the list was last published.
Updates
Trust center publishedGeneral
Published 9 September 2026This page now shows our certifications, subprocessors, controls and the documents behind them.Custom domains supportedGeneral
Published 5 September 2026A customer can now serve their trust center on their own hostname, with the certificate issued automatically.