# Enterprise-grade security

Autobound processes signal data for thousands of companies. We treat your data with the same rigor we'd expect for our own.

## SOC 2 Type II

Annual audits by independent third parties verify our security controls across availability, confidentiality, and privacy. Reports available under NDA.

## GDPR Compliant

Full compliance with the General Data Protection Regulation. Data processing agreements (DPAs) available for all enterprise customers.

## CCPA Compliant

California Consumer Privacy Act compliance with opt-out mechanisms, data deletion workflows, and transparent data practices.

# Security Practices

## How we protect your data

Our security architecture is designed for enterprise-grade data processing. Every layer, from network to application to operational, is built with defense in depth.

### Data Protection

**Encryption in Transit**  
TLS 1.3 enforced on all API endpoints. HSTS preloaded. Certificate pinning available for enterprise clients.

**Encryption at Rest**  
AES-256-GCM encryption for all stored data. Google Cloud KMS for key management with automatic rotation.

**Data Isolation**  
Tenant data is logically isolated at the database level. Enterprise customers can request dedicated infrastructure.

**Data Retention**  
Configurable retention policies. Signal data is retained per your plan terms. Full data deletion available on account closure.

### Access & Authentication

**API Key Authentication**  
Scoped API keys with configurable permissions. Keys can be rotated at any time without downtime.

**SSO / SAML**  
Enterprise SSO via SAML 2.0 and OpenID Connect. Integrates with Okta, Azure AD, Google Workspace, and other identity providers.

**Role-Based Access Control**  
Granular RBAC with predefined roles (Admin, Developer, Read-Only). Custom roles available on Enterprise plans.

**Audit Logging**  
Comprehensive audit logs for all API access, configuration changes, and user actions. Exportable for compliance reviews.

### Infrastructure

**Cloud Infrastructure**  
Hosted on Google Cloud Platform with multi-region redundancy. All infrastructure is managed via Terraform with version-controlled configurations.

**99.9% Uptime SLA**  
Enterprise-grade availability with automated failover. Real-time status monitoring and incident communication.

**DDoS Protection**  
Cloud Armor WAF with rate limiting, geographic filtering, and adaptive protection against volumetric and application-layer attacks.

**Network Security**  
VPC isolation, private service endpoints, and IP allowlisting available for enterprise customers. No public database endpoints.

### Monitoring & Response

**Continuous Monitoring**  
24/7 automated security monitoring with anomaly detection. Alerts on unusual access patterns, failed auth attempts, and data exfiltration indicators.

**Penetration Testing**  
Annual third-party penetration testing with remediation tracking. Enterprise customers can conduct their own assessments with prior coordination.

**Vulnerability Management**  
Automated dependency scanning, container image scanning, and SAST/DAST in CI/CD pipeline. Critical vulnerabilities patched within 24 hours.

**Incident Response**  
Documented incident response plan with defined severity levels, communication protocols, and post-incident review process. 1-hour acknowledgment SLA for critical issues.

## Statistics

- **2,500+** Companies trust Autobound
- **99.9%** Uptime SLA
- **0** Security breaches
- **<200ms** API response time

## Questions about security?

Our team is happy to answer questions, provide SOC 2 reports, or schedule a security review call.

[Contact Security Team→](https://www.autobound.ai/contact-sales) [Privacy Policy](https://www.autobound.ai/privacy-policy)