Compliance posture
Our compliance status as of 24 September 2026: certification, enforced controls, audit retention, and unset legal values.
Our status as of the last_updated date. Nothing listed here is aspirational.
Certification
We hold none; no audit report exists.
Enforced controls
Each control is enforced by the database or checked by our test suite, not left to convention.
| Control | Enforcement |
|---|---|
| Audit record integrity | Entries can be added and read, never edited or deleted, by any part of our application, ours included. Only expiry at the end of your plan's retention, or deleting the whole workspace, removes an entry. |
| Key management | Per-workspace data keys, wrapped by a key management service, with the wrapping key id recorded on every version. See encryption in the cloud. |
| Vendor management | Our subprocessor register is public and names the one that holds plaintext in memory. |
| Value handling | We never log a value. Showing one is an explicit, audited reveal. |
Every plan also has:
- No value in a log, an error, or a URL.
- Envelope encryption at rest and TLS in transit.
- An append-only audit record.
These are controls, not attestation. A report from an independent auditor is what attests them, and we do not have one yet.
Audit log retention
| Plan | Retention |
|---|---|
| Free | 14 days |
| Pro | 180 days |
| Enterprise | Not pruned automatically |
Entries older than your plan's retention are removed automatically, oldest first. While you stream your log to your own destination, we never remove an entry that destination has not received. See the audit log.
Enterprise additions
A signed data processing agreement. Encryption is identical on every plan. See billing and plans.
Unset legal values
Our privacy policy and terms of service highlight every value not yet set. Unset on this date: governing law, retention periods, transfer mechanism, and hosting regions, among others. Confirm any of these with us before you rely on it.