--- title: "Security | Cometly" description: "Learn how Cometly keeps your marketing data secure. SOC 2, GDPR-aligned, encrypted at rest and in transit, with enterprise-grade access controls." source: "https://www.cometly.com/security" --- Security & Trust # Security built for revenue data Cometly handles the data your finance, sales, and marketing teams run on, Stripe revenue, CRM pipeline, and ad-platform spend. We treat it the way you do: with strict access controls, independently audited processes, and encryption at every layer. Request security packetContact security → Trust Center · trust.cometly.com All controls passing Encryption AES-256 · TLS 1.2+ Compliance SOC 2 in progress · GDPR · DPA Identity RBAC · Audit logs · Session controls Uptime 99.9% SLA ## Independent audit underway. Continuously monitored SOC 2 Type 1 and Type II are in progress. We can share our auditor's letter of attestation, DPA, sub-processor list, and security questionnaire under NDA, usually the same business day. SOC 2 In progress SOC 2 Type 1 Independent audit of our security, availability, and confidentiality controls is underway. Auditor letter, DPA, and sub-processor list available under NDA so your security review can move forward today. SOC 2 Type II Continuous evaluation of our security controls over an extended period, following our Type 1 attestation. Reach out for our latest timeline. GDPR EU data subject rights, lawful basis tracking, and a published Data Processing Addendum. CCPA CCPA / CPRA California consumer rights honored, including access, deletion, and opt-out signals. PCI PCI DSS We never store raw card data. All payments are processed by Stripe, a Level 1 service provider. ISO In progress ISO 27001 On our compliance roadmap following SOC 2 completion. To receive copies of audit reports, our security questionnaire, or our DPA, email security@cometly.com. How we protect you ## Defense at every layer of the stack From the browser request to the row in our database, every layer of Cometly is built with security primitives that scale with your team and your traffic. 01, Data ### Your data, encrypted and isolated AES-256 at rest. TLS 1.2+ in transit. Per-workspace logical isolation, with field-level encryption for the most sensitive customer attributes. 02, Identity ### Strong authentication, by default Role-based permissions on every workspace, configurable session controls, and immutable audit logs of every workspace action. Audit logs are available on request. 03, Infrastructure ### Resilient cloud, by design Hosted on AWS in SOC 2-compliant regions. Production data is segregated from staging, with multi-AZ deployments and automated backups for resiliency. 04, Operations ### Continuous monitoring, tested annually Continuous automated monitoring and audit logging. Independent penetration testing and a responsible disclosure program with the security community. Data protection ## Encrypted, isolated, and yours alone Your customer data never co-mingles with another workspace. Every read and write is scoped to your tenant, and we test that boundary continuously. - Encryption at rest All data is encrypted at rest with AES-256, including primary databases, warehouse exports, backups, and object storage. - Encryption in transit All connections use TLS 1.2 or higher with HSTS preload. Older protocol versions are rejected at the edge. - Field-level encryption Sensitive customer attributes receive additional encryption protections beyond database-level encryption. - Key management Encryption keys are managed in AWS KMS and rotated in accordance with industry best practices. - Backups Automated, encrypted database backups with point-in-time recovery, replicated across availability zones for resiliency. - Tenant isolation Every workspace is logically isolated. Queries are scoped at the application layer and audited at the database layer. Application security ## Right access. Right people. Right log Identity and access are the foundation of trust. Cometly gives your IT and security teams the controls they expect, and the audit trail they need. Role-based access control Owner, Admin, Editor, and Viewer roles. Restrict access to billing, integrations, and sensitive workspaces. Session controls Configurable session length and inactivity timeouts. Forced re-authentication for sensitive actions. Audit logs Immutable logs of every workspace action, logins, integration changes, data exports, and role updates. Log exports are available on request. API key scoping Scoped, revocable API keys for controlled programmatic access. Infrastructure ## Built on infrastructure your security team already trusts We run on AWS in independently audited regions, and we operate the platform with the same on-call rigor as the rest of your tier-1 vendors. AWS, audited regions Production runs in AWS regions independently audited under SOC 2, ISO 27001, and PCI DSS, with multi-AZ deployments for high availability. Network protection All traffic flows through a hardened edge with rate limiting, WAF rules, and managed DDoS mitigation. Segregated environments Production data is segregated from staging and development environments. Vulnerability management Automated dependency and infrastructure vulnerability scanning, with findings prioritized and tracked to remediation. Penetration testing Independent third-party penetration testing of the application and infrastructure, with summary reports available to customers under NDA. Disaster recovery Documented disaster recovery procedures with backup restoration and recovery exercises tested at least annually. Privacy & data rights ## Privacy is a control surface, not a checkbox Cometly is built so the privacy promises you make to your customers stay enforceable end-to-end. From signed DPAs to in-product deletion tools, the controls are first-class. Data Processing Addendum Pre-signed DPA with Standard Contractual Clauses, available without negotiation for every customer. Data subject requests Documented processes to honor access, rectification, deletion, and export requests. Sub-processors Public sub-processor list, with 30-day advance notice of any additions or material changes. Data residency US data stays in US regions. Contact us about data residency requirements. Customer-owned data You own your data. Export anytime, and we'll permanently delete on request, typically within 30 days. Privacy policy What we collect, why, and your rights. DPA Pre-signed DPA with SCCs. Current vendors and providers. Operations & people ## Security is everyone's job, not a department The strongest controls are the ones a team actually lives. Our policies, training, and reviews are built to keep security at the top of mind for every Cometly engineer. 24×7 monitoring Automated monitoring and alerting on critical services, with engineers notified immediately of anomalies. Annual security training Every Cometly employee completes security and privacy training annually. Engineers complete additional secure-coding training. Background checks Pre-employment background checks where legally permitted. All employees sign confidentiality agreements before access. Least-privilege access Production access is gated, time-bound, and logged. Reviews happen quarterly and on every role change. Vendor reviews Every sub-processor goes through a security review before adoption, and is reviewed annually. Incident response Documented IR runbooks with defined severity levels. Customers are notified without undue delay for incidents that affect them. Responsible disclosure ## Found something? We want to hear from you We work with the security research community and welcome reports of potential vulnerabilities. Reports made in good faith, with no impact on customer data, won't be subject to legal action. security@cometly.comDisclosure policy → When you report - We confirm receipt within 1 business day. - We triage and respond with severity and next steps within 5 business days. - We keep you informed as the fix progresses through review and deploy. - We appreciate and acknowledge good-faith reports from the security community. FAQ ## The questions security teams ask us Need something not covered here? Our security team usually returns full questionnaires within one business day. Email security → Where is Cometly on SOC 2? Both SOC 2 Type 1 and SOC 2 Type II are in progress. We can share a letter of attestation from our auditor under NDA, along with our DPA, sub-processor list, and Privacy Policy, so your security team can start their review and procurement can move forward today. Email security@cometly.com to request the packet. Do you offer a Data Processing Addendum (DPA)? Yes. We have a pre-signed DPA with EU Standard Contractual Clauses available to every customer, no negotiation required. Enterprise customers can request a counter-signed version. Where is my data stored? Data is stored in AWS US regions by default. Contact sales to scope data residency requirements. AWS data centers are independently certified, including SOC 2 and ISO 27001. How is my data encrypted? All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Sensitive customer attributes are additionally protected with field-level encryption using rotating keys managed in AWS KMS. Do you support SSO and SAML? Not yet — SSO and SAML are on our roadmap. Today, every workspace ships with role-based access control, configurable session controls, and immutable audit logs. Log exports are available on request. Email security@cometly.com to discuss your IdP requirements. Are you GDPR and CCPA compliant? Yes. Cometly supports the data subject rights required under GDPR and CCPA, honors universal opt-out signals, and has documented processes for access, deletion, and export requests. Do you have an uptime SLA? Enterprise customers get a 99.9% uptime SLA with service credits. How do you handle security incidents? We follow a documented incident response plan with defined severity levels and escalation paths. Customers affected by an incident are notified without undue delay, with details and remediation steps. Do you conduct penetration tests? Yes. Independent third-party penetration tests are conducted against the application, infrastructure, and integration boundaries. Summary letters are available to customers under NDA. Where can I report a security issue? Email security@cometly.com for sensitive reports. We confirm receipt within one business day and respond with severity and next steps within five. ## Need to pass security review? We'll send our auditor's letter of attestation, DPA, and security questionnaire in one bundle, usually the same business day. Email securityTalk to sales