Security & trust

Security you'd expect from a Fortune 500, for a small business.

We build for restaurants, dentists and law firms. That means enterprise-grade infrastructure — quietly, in the background, on every plan.

Pillars

Four pillars, no shortcuts.

Every site runs on globally-distributed CDN infrastructure with automatic failover and DDoS protection.

TLS 1.3 in transit. AES-256 at rest. HSTS + preload enforced. No exceptions.

Our vendor stack (hosting, email, analytics, storage) is SOC 2 Type II certified. Our own controls follow the same posture.

GDPR, CCPA, PIPEDA. HIPAA-aware infrastructure available for medical clients on request.

Operational controls

Uptime, performance, error and security monitoring. Pages on-call within 60s of incidents.

Every code change, deployment and access event is logged. Client portal shows recent activity.

Team members get access only to the projects they're staffed on. Access is revoked automatically at project end.

Daily encrypted backups, 30-day retention, tested quarterly. Recovery time objective (RTO): under 4 hours.

Where is my data hosted?: By default, all client data is hosted in US East and EU West regions with automatic failover. On request, we can pin your data to a single region.
Do you sign DPAs?: Yes. Our standard Data Processing Agreement is available on request and covers GDPR, CCPA and PIPEDA.
Can you support HIPAA workloads?: For medical and healthcare clients, we deploy to a HIPAA-eligible infrastructure with signed BAAs. Contact us for a discovery call.
What happens to my data if I cancel?: You get a full export of your code, content and data. We delete our copies within 30 days unless you request longer retention for legal reasons.

Book a free 30-minute consultation. We'll map your growth plan and show you exactly what your subscription would look like.