How this is actually kept.
Specific answers rather than reassuring ones, because a security page full of adjectives is a security page nobody can check.
Separation is a boundary, not a where clause
Each organisation has its own database and its own storage bucket. Not a tenant column, not a scoped query: a separate database, created when the organisation is. That means a missing filter in application code cannot expose one customer to another, because there is nothing in the connection to expose.
The same holds for payloads. A bucket per organisation means the object store enforces the boundary, rather than a prefix string that has to be assembled correctly every time.
Database per organisation
Created and migrated when the organisation is, dropped when it leaves.
Bucket per organisation
Or your own bucket, with your own credentials, which we then hold no keys to.
Sessions scoped
A session minted on one organisations host cannot be replayed on another.
Credentials and tokens
Bucket credentials that you supply are stored encrypted, so they are not readable in a database dump. API tokens are scoped: a token that may read issues cannot change them, and the check is on the ability rather than on the HTTP method, which is what keeps the MCP endpoint honest given that every MCP call is a POST.
Sending events and reading them back are separate credentials entirely. An ingest key lives in a public JavaScript bundle, so it is expected to leak, and one that does cannot read anything back.
What we ask of you
Turn on single sign-on if you have it, keep the owner role on somebody who is still at the company, and scrub what your own application logs before it reaches any monitoring tool, ours included. The scrubber catches the usual field names; it cannot catch a token you wrote into a log message yourself.
Reporting something
Mail the security address on the contact page. We answer, we do not send legal threats to researchers, and we will tell you when it is fixed. If it affected your data we will tell you that too, whether or not you asked.
Questions people actually ask
Do you have ISO 27001 or SOC 2?
No, and claiming otherwise would be the fastest way to lose the argument this whole site is making. What there is: a documented architecture, separation enforced by the database and the object store, a published sub-processor list, and a signed DPA.
Is everything encrypted in transit?
Yes, TLS on every endpoint including ingest. Payloads are stored compressed; bucket credentials you supply are stored encrypted.
Can we run a penetration test?
Ask first, then yes. Tell us the window and the source addresses so we do not treat it as an incident.
Fourteen days of Team, without a card.
Sign up with your work address, prove your domain with one DNS record, and paste a DSN. The first stack trace usually arrives before the coffee does.
No card. The trial ends by itself and drops to Free; nothing is charged unless you choose a plan.
