Every box ticked,
nothing traded away
The controls a payments-adjacent workload asks for: scoped access, encryption end to end, regional redundancy, and uptime commitments written down rather than implied.
SOC 2
SOC 2 Type II attested. Audit completed with Harborline Assurance; report available under NDA.
GDPR
GDPR compliant, with DPAs, records of processing, and subject requests handled in-product.
Data encryption
Encrypted at rest with AES-256 and in transit over TLS 1.3, keys rotated on a 90-day cycle.
Uptime SLAs
99.97% API availability, with a named contact who calls you before your dashboard does.
DDoS protection
Volumetric and application-layer filtering in front of every send endpoint, tuned per tenant.
Scoped API keys
Issue keys limited to a domain, a template set, or a single environment. Revoke without a redeploy.
Automated backups
Suppression lists and event logs snapshot hourly and retained across two regions for 14 days.
Penetration testing
Twice-yearly external tests by Ridgemark Labs, plus continuous dependency and secret scanning.