Security built for
revenue data.
Cometly handles the data your finance, sales, and marketing teams run on, Stripe revenue, CRM pipeline, and ad-platform spend. We treat it the way you do: with strict access controls, processes we are preparing for independent SOC 2 audit, and encryption at every layer.
SOC 2 in progress. Continuously monitored.
SOC 2 Type 1 and Type II are in progress. We are working toward SOC 2 using the Delve compliance platform. Our DPA, sub-processor list, and security questionnaire responses are available on request.
We are working toward SOC 2 using the Delve compliance platform. Our DPA, sub-processor list, and security questionnaire responses are available on request.
Continuous evaluation of our security controls over an extended period, following completion of our Type 1 audit. Reach out for our latest timeline.
EU data subject rights, lawful basis tracking, and a published Data Processing Addendum.
California consumer rights honored, including access, deletion, and opt-out of sale or sharing.
We never store raw card data. All payments are processed by Stripe, a Level 1 service provider.
On our compliance roadmap following SOC 2 completion.
To request our security questionnaire responses, sub-processor list, or DPA, email security@cometly.com.
Defense at every layer of the stack.
From the browser request to the row in our database, every layer of Cometly is built with security primitives that scale with your team and your traffic.
Your data, encrypted and isolated.
AES-256 at rest. TLS 1.2+ in transit. Per-workspace logical isolation. Integration credentials (OAuth tokens, export secrets) are additionally encrypted at the application layer.
Strong authentication, by default.
Role-based permissions on every workspace, optional two-factor authentication, and audit logging of all AI and MCP tool calls, retained 90 days. Broader workspace audit logging is on our roadmap.
Resilient cloud, by design.
Hosted in US regions on Laravel Cloud, AWS, and SingleStore Helios, whose infrastructure holds SOC 2 and ISO 27001 certifications. Production data is segregated from staging, with automated backups for resiliency.
Continuous monitoring and scanning.
Continuous automated monitoring and audit logging. Continuous automated code and dependency scanning, and a responsible disclosure program with the security community.
Encrypted, isolated, and yours alone.
Your customer data never co-mingles with another workspace. Every read and write is scoped to your tenant, and we test that boundary continuously.
- Encryption at rest
All data is encrypted at rest with AES-256 by our infrastructure providers, including primary databases, backups, and object storage.
- Encryption in transit
TLS 1.2 or higher, enforced at the edge.
- Application-layer encryption
Integration credentials (OAuth tokens, export secrets) are additionally encrypted at the application layer.
- Key management
Encryption at rest is provided and key-managed by our infrastructure providers (SingleStore, AWS, Laravel Cloud). Cometly does not hold customer-data encryption keys.
- Backups
Automated encrypted backups managed by SingleStore and Laravel Cloud.
- Tenant isolation
Every workspace is logically isolated. Queries are scoped to your workspace at the application layer.
Right access. Right people. Right log.
Identity and access are the foundation of trust. Cometly gives your IT and security teams the controls they expect, and the audit trail they need.
Owner, Administrator, and Member roles at the account level; Administrator, Advertiser, and Viewer roles at the workspace level.
Sessions expire after 120 minutes of inactivity. Optional two-factor authentication (TOTP) is available to every user.
Audit logging of all AI and MCP tool calls, retained 90 days. Broader workspace audit logging is on our roadmap.
Scoped, revocable API keys for controlled programmatic access.
Built on infrastructure your security team already trusts.
We run on Laravel Cloud, AWS, and SingleStore Helios in US regions, on infrastructure that holds SOC 2 and ISO 27001 certifications.
Hosted in US regions on Laravel Cloud, AWS, and SingleStore Helios, whose infrastructure holds SOC 2 and ISO 27001 certifications.
Traffic is fronted by Cloudflare for DDoS mitigation and edge protection, with application-level rate limiting.
Production data is segregated from staging and development environments.
Continuous dependency and static code scanning via Aikido, with findings triaged and tracked to remediation.
A third-party penetration test is planned as part of our SOC 2 program. Continuous automated scanning (Aikido) runs today.
Documented backup and restore procedures.
Privacy is a control surface, not a checkbox.
Cometly is built so the privacy promises you make to your customers stay enforceable end-to-end. From signed DPAs to in-product deletion tools, the controls are first-class.
Pre-signed DPA with Standard Contractual Clauses, available without negotiation for every customer.
Documented processes to honor access, rectification, deletion, and export requests.
Public sub-processor list, with 30-day advance notice of any additions or material changes.
US data stays in US regions. Contact us about data residency requirements.
You own your data. Export anytime, and we'll permanently delete on request, typically within 30 days.
Security is everyone's job, not a department.
The strongest controls are the ones a team actually lives. Our policies, training, and reviews are built to keep security at the top of mind for every Cometly engineer.
Continuous automated monitoring (Sentry, Aikido) with alerting to the engineering team.
As part of our SOC 2 program, every Cometly employee completes security and privacy training annually.
As part of our SOC 2 program, we are formalising pre-employment background checks where legally permitted. All employees sign confidentiality agreements before access.
Production access is gated and logged. As part of our SOC 2 program, we are formalising quarterly access reviews.
As part of our SOC 2 program, we are formalising security reviews of every sub-processor before adoption and annually thereafter.
Documented IR runbooks with defined severity levels. Customers are notified without undue delay for incidents that affect them.
Found something? We want to hear from you.
We work with the security research community and welcome reports of potential vulnerabilities. Reports made in good faith, with no impact on customer data, won't be subject to legal action.
- We aim to acknowledge reports within two business days.
- We triage each report and keep you informed as the fix progresses through review and deploy.
- We appreciate and acknowledge good-faith reports from the security community.
The questions security teams ask us.
Need something not covered here? Email our security team and we'll get back to you.
Email securityWhere is Cometly on SOC 2?
Both SOC 2 Type 1 and SOC 2 Type II are in progress. We are working toward SOC 2 using the Delve compliance platform. Our DPA, sub-processor list, and security questionnaire responses are available on request so your security team can start their review today. Email security@cometly.com to request the packet.
Do you offer a Data Processing Addendum (DPA)?
Yes. We have a pre-signed DPA with EU Standard Contractual Clauses available to every customer, no negotiation required. Enterprise customers can request a counter-signed version.
Where is my data stored?
Data is hosted in US regions on Laravel Cloud, AWS, and SingleStore Helios, whose infrastructure holds SOC 2 and ISO 27001 certifications. Contact sales to scope data residency requirements.
How is my data encrypted?
All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Encryption at rest is provided and key-managed by our infrastructure providers (SingleStore, AWS, Laravel Cloud); Cometly does not hold customer-data encryption keys. Integration credentials (OAuth tokens, export secrets) are additionally encrypted at the application layer.
Do you support SSO and SAML?
Not yet — SSO and SAML are on our roadmap. Today, every workspace ships with role-based access control, optional two-factor authentication (TOTP), and audit logging of all AI and MCP tool calls, retained 90 days. Email security@cometly.com to discuss your IdP requirements.
Are you GDPR and CCPA compliant?
Yes. Cometly supports the data subject rights required under GDPR and CCPA and has documented processes for access, deletion, and export requests.
How do you handle security incidents?
We follow a documented incident response plan with defined severity levels and escalation paths. Customers affected by an incident are notified without undue delay, with details and remediation steps.
Do you conduct penetration tests?
Not yet. We run continuous automated scanning (Aikido) today and plan a third-party penetration test as part of our SOC 2 program.
Where can I report a security issue?
Email security@cometly.com for sensitive reports. We aim to acknowledge reports within two business days.
Need to pass security review?
We'll send our SOC 2 program documentation, DPA, and security questionnaire responses in one bundle.