Stated plainly, as the Security Overview states it.
We do not hold SOC 2 or ISO/IEC 27001 certification. Our infrastructure providers do, and their reports are available from them.
We have not commissioned an independent third-party penetration test to date.
We do not operate a 24/7 staffed security operations centre.
We do not offer a contractual uptime commitment; enterprise service levels are agreed separately.
Changes are not yet required to pass a second person's review or the automated gates before they are released.
Our recovery procedure has not yet been exercised in a restore drill, and recovery point and recovery time objectives are not yet defined.
Database row-level security is switched on in staging but not yet in production; isolation there rests on the data-access layer.
Default retention periods are not yet enforced automatically: the scheduled housekeeping that would enforce them is not running.
Every organization's data is stored in the European Union. The product records a data region for each organization, but only the EU region is provisioned, and a customer cannot choose another yet.