Everything your security team needs to review us, in one place, without a call: what we protect, what we never collect, and what is not in place yet. Where a control is missing we say so and show when it is planned — an honest gap is easier to review than a vague claim.
Most vendors answer a security review by describing how well they guard your data. We would rather reduce what there is to guard. Three properties do most of the work.
We operate a safe-harbour policy. Report a vulnerability in good faith and we will not pursue legal action, will respond within one business day, and will credit you unless you would rather we did not.
PGP key and security.txt published at /.well-known/security.txt
Every claim on it about coordination — no double-booking, a signed history that hasn’t been edited — is checkable by you, on your own machine, against a key we published before the run existed. A trust centre that asks for trust is a weaker document than one that hands you the evidence.