Data processing — Security

We implement appropriate technical and organisational measures to protect Customer Personal Data, taking account of the state of the art, the cost of implementation, and the nature and risk of the processing, as required by Article 32. Those measures are described in Annex II and in more detail on the security page. What we do not have, stated here rather than found later. RowFold holds no SOC 2 report and no ISO 27001 certification, has not had a third-party penetration test, offers no customer-managed encryption keys and no choice of data region, and does not offer a contractual uptime guarantee. The compliance page is the full account. If any of those is a gating requirement for you, it is better learned now than at renewal. We may update our security measures over time, provided the level of protection is not reduced.