TrustSecurity & compliance
How we protect your data.
Last updated · May 19, 2026
The frameworks, controls, and practices that keep customer data safe at Embedder.
Frameworks
- SOC 2 Type II
- Continuous controls monitoring across infrastructure, identity, change management, and incident response.
- ISO 27001
- Information security management system covering risk assessment, asset management, supplier security, and continuous improvement.
- GDPR
- Data subject rights, lawful basis records, processor agreements, and EU data transfer safeguards.
Security practices
- Encryption
- Industry-standard TLS for data in transit and strong encryption at rest. Customer secrets are isolated in a managed secret store and never embedded in application code or images.
- Access control
- SSO with mandatory MFA. Production access is role-based, least-privilege, and time-bound. Privileged actions are reviewed and audited.
- Monitoring & audit
- Centralized audit logging across identity, secrets, and infrastructure. Real-time alerting on anomalous activity, with documented incident response runbooks.
- Change management
- Infrastructure and application changes go through peer review, automated checks, and a tested rollback path. No direct production access.
- Vulnerability management
- Automated dependency, code, and secret scanning on every change. Findings are tracked to remediation and dependencies are pinned for reproducible builds.
- Backup & recovery
- Continuous database backups with point-in-time recovery. Versioned object storage and tested restore procedures.
Reports & evidence
Request a report
Enterprise customers can request our latest SOC 2 report and a controls evidence summary under NDA. Reach out at [email protected].