Our compliance status
gtm.help does not yet hold its own SOC 2 report. We are a small team and we would rather say so than imply otherwise. The services we run on — hosting, database and payments — are independently audited, and the controls below are in place today.
Hosting and infrastructure
- Cloudflare serves the app and protects it from abuse and traffic floods. Cloudflare holds SOC 2 Type II and ISO 27001 certifications.
- Supabase, running on AWS, hosts the database, sign-in and file storage. Supabase holds a SOC 2 Type II report; AWS holds SOC 2 and ISO 27001.
- Stripe handles every card payment. Stripe is PCI DSS Level 1 certified. Card numbers never touch our servers.
Encryption
All traffic uses HTTPS (TLS 1.2 or higher). Data is encrypted at rest in the database, file storage and backups (AES-256).
Keeping accounts separate
Every record is tied to a workspace and protected by row-level access rules in the database, so one customer cannot read another customer's plan, chats or uploads. Privileged database actions run only in server-side code, never in the browser.
Sign-in and sessions
- Passwords are stored as one-way hashes; we never see them.
- Changing or resetting a password signs out every other device.
- Passwordless email links and Google sign-in are supported.
- Sign-in and API endpoints are rate limited.
AI and your data
Only the parts of your workspace needed for a task are sent to AI model providers through our gateway. Those providers are contractually bound not to train their models on your content, and we never use your private workspace to train public models.
Connected accounts
Outside accounts you choose to connect are linked through Composio. We store access tokens, not passwords, and you can disconnect at any time from settings.
Team access and backups
Access to production data is limited to the people who need it to support you. Backups run automatically and are encrypted. When you delete your account, data is removed from live systems within 30 days and from backups within 90 days.
Incidents
If a breach ever affects your data, we will tell you and any relevant regulator without undue delay, with what happened and what we are doing about it.
Documents on request
Email team@gtm.help for a Data Processing Agreement, our security overview, our list of sub-processors, or help with a security questionnaire. We reply within seven working days.
Report a security issue
Found something? Email team@gtm.help with "Security issue" in the subject. Please give us a reasonable time to fix it before sharing it publicly. We do not take legal action against good-faith research. Our machine-readable contact file is at /.well-known/security.txt.