Skip to content

Trust

Security, as shipped.
No invented badges.

These are the MVP controls we run today. Formal certifications ship only with an enterprise deal. Invite-only US product — not a compliance guarantee.

MVP controls

  • Tenant isolation

    Every tenant-owned row carries organization_id. Client roles never cross tenants.

  • Auth & access

    JWT sessions and membership roles. Ops staff stay scoped to ops endpoints.

  • Webhook integrity

    HMAC signatures plus timestamp skew checks on inbound lead webhooks.

  • Decision audit

    Qualification stores policy version, inputs, score contributions, result, and overrides.

  • Transport & secrets

    TLS in transit. Production secrets live in a secret manager — not dumped in logs.

  • PII discipline

    Operational logs aim to mask phone and email. Retention is configurable per deployment.

Not claimed

No SOC 2

We do not list a badge we do not have.

No ISO 27001

Same rule. Formal certs are not invented here.

Enterprise only

Certifications are scoped with an enterprise deal.

Request a security questionnaire

Related: Privacy and Subprocessors.