Compliance
GDPRDPA · EU hosting · SCCs
UK GDPRUK Addendum to the SCCs
CCPA / CPRAService provider terms
SOC 2 Trust Services CriteriaControls mapped to all criteria
Resources
View allLegal and privacy
Controls
46 in place · reviewed 21 Sep 2026- Sign in with Google or Microsoft
- Multi-factor authentication
- Custom roles with granular permissions
- Customer data hosted in the EU
- Encryption at rest with AES-256
- Encryption in transit
- Automated checks on every release
- Short-lived deploy credentials
- Automatic rollback
- No open web ports
- Database isolated from the internet
- Edge protection by Cloudflare
- Company Apple MacBooks only
- Full-disk encryption with FileVault
- Automatic security updates
- Two-factor authentication everywhere
- Security training for every employee
- Documented security policies
- No storage at our AI provider
- No training on API data
- Prediction models trained per workspace
Data we process
- Business account and CRM data
- Business contact details (name, email, job title)
- Product usage and support activity
- Meeting and email content you connect
- Full payment card numbers
- Health or other special-category data
Subprocessors
View all 19Amazon Web Services (AWS)
Cloud hosting and database; Customer Data stored at rest · European Union (Ireland)
Cloudflare
Network edge, TLS and secure tunnel for the GainTrace app; website hosting for gaintrace.com · Global
Anthropic
Large language model provider for generative AI features · United States
OpenAI
Large language model provider for generative AI features · United States
PostHog
Product analytics and session replay · European Union
