Audited
SOC 2 Type II
Security, availability and confidentiality controls assessed against the AICPA trust services criteria.
- Auditor
- Lattice Assurance
- Scope
- 128 controls
- Valid through
- Sep 30, 2027
Trust center · last reviewed Nov 04, 2026
Certifications, controls, data flows and subprocessors — every claim on this page has a document behind it. If something looks off, tell us before anyone else does.
Assurance snapshot
All checks passingSOC 2 Type II
Valid to Sep 2027
ISO/IEC 27001:2022
Valid to Feb 2028
Last penetration test
0 critical findings
Critical patch median
100% within SLA
01Certifications
We keep the reports current instead of framing the badge. Every certificate links to an auditor, a scope and an expiry date.
Next surveillance audit · Feb 2027
Security, availability and confidentiality controls assessed against the AICPA trust services criteria.
Our information security management system is certified across engineering, infrastructure and support.
Privacy information management extension covering personal data, consent and processor obligations.
Administrative, physical and technical safeguards reviewed for protected health information workloads.
Standard contractual clauses, the UK addendum and participation in the EU-US Data Privacy Framework.
Card data is tokenised by our payment subprocessor. Arclight systems never store primary account numbers.
02Controls
Policies are only as good as the systems enforcing them. These are the controls we run in production, not a theoretical checklist.
128 controls · 4 domains
Applied to every workspace, backup and secret
01
TLS 1.3 in transit
HSTS preloaded, strong ciphers only
02
AES-256 at rest
Every volume and backup encrypted
03
90-day key rotation
Managed KMS, customer keys on Enterprise
04
Field-level secrets
Tokens and webhook keys sealed separately
SSO, MFA and least privilege
Last review · 6 days ago
From commit to production
Detection before escalation
214 alert rules · 3 regions
Tested, not assumed
Restore test · passed Oct 2026
03Data handling
Choose a region at workspace creation. We keep content, backups and audit evidence in that region, with a clear retention clock.
DPA v4.2 · effective Oct 2026
N. Virginia
Primary and disaster recovery in-region
Ireland
Primary and disaster recovery in-region
Sydney
Primary and disaster recovery in-region
| Data class | Purpose | Retention | Residency |
|---|---|---|---|
| Workspace content | Service delivery | Until deleted + 30 days | Customer region |
| Authentication logs | Security and abuse prevention | 12 months | US / EU |
| Audit events | Compliance evidence | 24 months | Customer region |
| Support attachments | Issue resolution | 24 months | US / EU |
| Encrypted backups | Disaster recovery | 35 days rolling | Customer region |
| Billing records | Tax and invoice obligations | 7 years | US / EU |
Written into every contract
04Subprocessors
Every provider that can touch customer data is listed here with its purpose, region and security posture. Changes are announced 30 days ahead.
9 providers · updated Nov 04, 2026
| Provider | Purpose | Data categories | Region | Safeguards | Status |
|---|---|---|---|---|---|
VC Vela Compute Cloud hosting | Compute and managed Kubernetes | Customer contentMetadata | US · EU · AP | SOC 2ISO 27001 | Active |
CS Cinder Storage Object storage | Files, assets and encrypted backups | Customer contentBackups | Customer region | SOC 2ISO 27001 | Active |
HE Harbor Edge CDN and WAF | Edge delivery and request filtering | Request metadataIP address | Global edge | SOC 2ISO 27001 | Active |
KI Keystone Identity Identity provider | Enterprise SSO and directory sync | Account dataDirectory attributes | US · EU | SOC 2ISO 27001 | Active |
RM Relay Mail Email delivery | Transactional and notification email | Email addressMessage metadata | US · EU | SOC 2DPA | Active |
LA Lumen Analytics Product analytics | Aggregated product usage insights | Pseudonymous usage data | EU | SOC 2DPA | Active |
QA Quarry AI AI inference | Optional AI features, disabled by default | Prompt contentMetadata | US · EU | SOC 2DPA | Planned |
SD Signal Desk Support platform | Support tickets and live chat | Support contentContact data | US | SOC 2DPA | Active |
NB Northstar Billing Payments | Invoicing and tokenised card payments | Billing dataTokenised card | US · EU | PCI DSSSOC 2 | Active |
All providers are bound by a data processing agreement and reviewed annually.
Swipe sideways to see every column.
05Documents
Public documents are released instantly. Audit reports and test summaries are shared under NDA after a short review.
6 documents · 5.8 MB total
The whole program in one document
Audited controls, tests and evidence
Certified ISMS scope and validity
SCCs, UK addendum and DPF terms
Q3 2026 external assessment
Current list with a full change log
Need something that is not listed? Ask the security team directly.
[email protected]06Responsible disclosure
We welcome good-faith research. Reports go straight to the security engineering team, not a ticket bot.
Median first reply · 6 hours
A security engineer confirms receipt and assigns a tracking reference.
We reproduce the issue, agree a severity and set a disclosure window with you.
Critical issues ship first. You receive a short summary once the fix is verified.
We credit researchers who want it, and we do not pursue good-faith research.
We will not pursue legal action for good-faith testing that respects our scope, avoids privacy violations and gives us reasonable time to fix the issue.
PGP key
Encrypt sensitive details
4A7F 19C2 88DE 6B30 7F41 2D5C 90A8 3E17
Encrypted in transit. We reply within one business day.