Trust Center
Four Pillars of Enterprise Readiness
Security, identity, infrastructure, and support, each pillar engineered to clear your most rigorous procurement reviews.
SECURITY & COMPLIANCE
Where we are on compliance
SOC 2 Type II is planned; there is no audit report yet
Card payments run through Stripe, so card data never touches Aforo
Data-subject request queue and breach-incident register
Hosted in the US (AWS us-east-1)
IDENTITY & ACCESS MANAGEMENT
Access you control
Role-based access with system and custom roles
SCIM provisioning for your team
MFA enforcement and session TTL policies, switched on during onboarding
Workspace SSO (SAML 2.0 / OIDC) is in progress
DEPLOYMENT & INFRASTRUCTURE
How it runs
Workspace-scoped data in every service
Metering is asynchronous and fails open, so your API keeps serving
Usage and billing exports to your own S3 bucket
One AWS region (US) today
SUPPORT & OPERATIONS
White-Glove Support
Dedicated Technical Account Manager (TAM)
Shared Slack Connect Channel for real-time triage
Custom MSAs & Invoicing
24/7 Severity 1 incident paging
5
Gateway integrations
Kong, Apigee, AWS, Azure APIM, MuleSoft
Fail-open
Metering path
After the response on Kong, AWS, Azure and MuleSoft; on Apigee a bounded wait before it
Per workspace
Data scoping
Every record carries its workspace
Security Architecture
Defense in Depth, by Design
Not bolted on after launch. Every security control is part of the core architecture from day one.
Data Protection
01Card data is handled by Stripe and never touches Aforo (PCI SAQ-A scope)
02Public endpoints are served over HTTPS only
03Outbound webhooks are signed with HMAC-SHA256 so you can verify the sender
Identity & Authentication
01Storefront sign-in for your customers with OAuth and SSO; workspace SSO for your team is in progress
02MFA enforcement with configurable session TTL, switched on during onboarding
03Your team’s active sessions are listed in the admin panel and can be revoked there
Workspace Isolation
01Every query is filtered by workspace; a request for another workspace’s record returns 404
02Cache keys always include the workspace
03Workspace context is carried through every service call, scheduled job and background worker
Audit & Observability
01Audit trail on every configuration and financial change
02Distributed tracing (OpenTelemetry) across all 11 microservices
03Exportable audit logs for vendor security reviews
Procurement Ready
Pass your vendor security review on the first attempt
Security questionnaires answered by the engineers who built the platform
Card data handled by Stripe (PCI SAQ-A scope)
Custom MSA and security addendum supported
Custom SLA terms documented in the Enterprise contract
A named contact for your rollout
Data hosted in the US; other regions when customers need them
SOC 2 Type II and a penetration test are planned; ask us for dates
Ready to clear your security review?
Our enterprise team will walk your InfoSec, Engineering, and Procurement stakeholders through the full security architecture, compliance posture, and deployment options.