Security — What we don't have yet

Read this section first if you are evaluating us for a regulated environment. Everything above ships today. Everything here does not, and we would rather you learn it from us than discover it during procurement. • No SOC 2 or ISO 27001 report. We have not completed an audit against either framework. If your procurement process requires one, we are not yet a fit. • No third-party penetration test. The application has been reviewed internally and adversarially, but not by an external firm, and we will publish the summary when that changes. • No bug bounty programme. We publish a disclosure policy with safe-harbour terms and act on reports (see section 11), but we do not currently pay for them.