Harborline · Trust Centre
Everything your security review needs on one page: our current compliance posture, the subprocessors we rely on, how customer data is handled, and a private channel for reporting security issues.
Written for the people who fill in vendor questionnaires — procurement, security and legal. If something you need is missing, ask and we will add it.
Where we stand today, stated in words rather than badges. Each programme below is either audited, contractually covered or honestly marked as in progress — and the paperwork is available on request.
Report available under NDA
An independent auditor examines our security, availability and confidentiality controls every year. The current report covers the twelve months to March 2026. Request it through the disclosure form below or from your account manager — a mutual NDA applies.
DPA available
We act as a processor for customer content. Our standard data processing agreement includes the EU Standard Contractual Clauses and the UK Addendum, and stays aligned with the subprocessor list on this page. Countersigned copies usually come back within two business days.
Certification in progress
Our information security management system follows ISO 27001:2022 and the stage 1 audit is complete. We expect certification in the first half of 2027 and will publish the certificate number here once issued — until then we make no certification claim.
Third parties that may process customer data on our behalf. We give customers thirty days' written notice before adding or replacing a subprocessor, with the right to object in the DPA.
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Application hosting, storage and managed databases | EU (Ireland), backups in EU (Frankfurt) |
| Cloudflare | Content delivery, DNS and DDoS protection | Global edge network |
| Postmark | Transactional email delivery | United States |
| Stripe | Payment processing — cardholder data never touches our systems | United States / EU |
| Datadog | Infrastructure monitoring, logging and alerting | EU (Germany) |
| Plain | Customer support conversations | EU (Ireland) |
The short version of our data-handling practices. The full detail lives in the DPA and the SOC 2 report — both available through the disclosure form below.
Data in transit is protected with TLS 1.2 or newer; data at rest with AES-256. Keys live in a managed key management service, rotate automatically and are never stored alongside the data they protect.
Customer content is kept for as long as your contract runs. After termination we delete it from production within 30 days and from encrypted backups within 90 days — sooner on written request.
Production access is limited to a small on-call group behind single sign-on and hardware-key MFA, granted just-in-time and fully logged. Support engineers see customer content only with your written consent.
Found a vulnerability, or have a security question your questionnaire does not cover? Use this private channel. We read every report and will not pursue good-faith research that respects user privacy and gives us reasonable time to respond.
The questions vendor reviews ask most often. If yours is not here, send it through the disclosure form and we will answer — and usually add it.
Yes. The current SOC 2 Type II report is available under a mutual NDA — request it through the disclosure form on this page or from your account manager, and we will usually turn it around within two business days.
We offer a standard data processing agreement that includes the EU Standard Contractual Clauses and the UK Addendum, kept aligned with the subprocessor list published here. If your legal team needs changes, send the redline to the security address on this page.
Production runs on AWS in the EU (Ireland) region, with encrypted backups in EU (Frankfurt). Customer content stays in those regions; a small number of subprocessors listed above process limited data elsewhere, for example transactional email delivery in the United States.
Report privately through the disclosure form below or by email to the security address shown on this page. We acknowledge within two business days, keep you updated while we fix, and do not pursue good-faith researchers who respect user privacy and give us reasonable time to respond.
Yes — SAML 2.0 single sign-on and SCIM provisioning are included on Business and Enterprise plans, with MFA enforcement available for members who sign in with a password.