Trust center
How we protect your data.
The controls we run on ourselves, how we handle customer data, who processes it on our behalf, and the certifications our team holds.
Security practices
The controls we run on ourselves.
The same practices we deliver to clients, applied to our own environment first.
Access control
Single sign-on and multi-factor authentication for staff, least-privilege roles and periodic access reviews.
Encryption
Customer data encrypted in transit and at rest; keys managed in a cloud key management service.
Secure development
Peer-reviewed changes, automated code and dependency scanning, and deployments only through CI/CD.
Monitoring
Centralized logging and 24/7 monitoring of our own environment by our security operations team.
Testing
Independent penetration tests of the platform, with findings tracked to verified fix.
Incident response
A documented, exercised incident response plan with customer notification steps.
People
Background checks before hire where local law allows, confidentiality agreements, and security awareness training at hire and every year.
Data handling
Your data stays yours.
The full terms are in your agreement and data processing addendum (DPA).
- We process customer data only to deliver the services in your agreement.
- Customer environments are logically separated by tenant.
- Data is retained for the period in your agreement, then deleted.
- You can request export or deletion of your data at any time.
- Staff access to customer data is limited, logged and reviewed.
Certifications
Certified people, not a certified company.
Resilient Privacy does not hold a company audit report or certification such as SOC 2 or ISO 27001. Our team holds these individual certifications.
- CISSP
- Security leadership and architecture
- CISM
- Security program management
- CISA
- Information systems audit
- OSCP
- Hands-on penetration testing
- CEH
- Ethical hacking
- Security+
- Security fundamentals
- CCNA
- Networking
Subprocessors
Who processes data for us.
The vendors that process data for this website and our hiring. Tools used in client engagements are listed in each engagement's agreement. We give notice before adding a subprocessor.
| Subprocessor | Purpose | Website |
|---|---|---|
| Vercel | Website hosting | vercel.com (opens in a new tab) |
| Resend | Delivery of website form email | resend.com (opens in a new tab) |
| Binary | Careers applications | binary.so (opens in a new tab) |
Questions, reports or a security review?
Request our security documentation, send a completed questionnaire, or report a vulnerability under our disclosure policy. We reply from a named person.
Security your auditors and customers can check.
Talk to us about your own security and compliance program.