Security & Data Handling

Controls

• Access control: role-based permissions, least privilege, and periodic access reviews for our workforce.
• Encryption: TLS for data in transit for supported endpoints; encryption for sensitive data at rest where architected.
• Logging and monitoring: centralized logs for security-relevant events and alerting for anomalies.
• Vendor management: security review for material subprocessors and contractual security commitments.
• Incident response: documented playbooks, containment, customer notification when appropriate, and post-incident review.

Customer responsibilities

You must configure MFA where offered, protect administrator credentials, promptly offboard former employees, and classify data you upload appropriately.