Security and data protection
What we enforce ourselves, the certified infrastructure we run on, and the documents your security team can ask for.
What we enforce
Encrypted in transit and at rest
TLS on every connection. Databases and file storage are encrypted at rest by our infrastructure providers.
Row-level access control
Tables are protected by database-level access policies, so an account can only read what it is allowed to.
Role-based team access
Staff access is role-based, including read-only roles, and secrets stay on the server.
Bot and abuse protection
Sign-in and public forms are protected by bot checks and rate limits, using Cloudflare Turnstile.
No card data
Payments run through Stripe. Card numbers never reach our systems.
Consent by design
Explicit, per-channel opt-in, and only the data a program needs, asked for when it is earned.
Certified infrastructure
Augmento runs on providers that hold these certifications. They are our partners' certifications, not ours: Augmento itself does not hold ISO 27001 or SOC 2.
Partner | What it runs for us | Their certifications |
|---|---|---|
| Supabase | Database and authentication | SOC 2 Type 2, ISO 27001, HIPAA (with a BAA), GDPR |
| Vercel | Application hosting | SOC 2 Type 2, ISO 27001, PCI DSS v4.0, HIPAA, GDPR, EU-US Data Privacy Framework, TISAX Level 2 |
| Cloudflare | File storage, media delivery and bot protection | ISO 27001:2022, ISO 27701, ISO 27017, ISO 27018, SOC 2 Type II, PCI DSS 4.0, FedRAMP High, EU Cloud Code of Conduct |
| Amazon Web Services | Regional hosting where a program requires it | ISO 27001, SOC 1, SOC 2 and SOC 3, PCI DSS Level 1 |
| Stripe | Payments | PCI DSS Level 1 service provider, SOC 1 and SOC 2 |
Privacy law
GDPR and PDPL
Consent is explicit and opt-in, as the EU's GDPR and the UAE's PDPL require.
LGPD and CCPA
Programs in Brazil and California follow LGPD and CCPA rules on consent, access and deletion.
EU hosting by default
Our primary database runs in the EU. Where a program requires another region, its data is hosted there.
Documents on request
Data processing agreement
Sent on request, with the processing details for your program.
Sub-processor list
Every third party that processes data for us, published at augmento.com/subprocessors.
Privacy policy
How we handle personal data, published at augmento.com/privacy.
Security questionnaires
Send us your security or vendor questionnaire and we complete it.
Security questions
Talk to us about security
Send your questionnaire or ask for the DPA. We reply from an augmento.com address, usually within two business days.