Security and data protection.
What we enforce ourselves, the certified infrastructure we run on, and the documents your security team can ask for.
What we enforce.
Encrypted in transit and at rest
//01TLS on every connection. Databases and file storage are encrypted at rest by our infrastructure providers.
Row-level access control
//02Tables are protected by database-level access policies, so an account can only read what it is allowed to.
Role-based team access
//03Staff access is role-based, including read-only roles, and secrets stay on the server.
Bot and abuse protection
//04Sign-in and public forms are protected by bot checks and rate limits, using Cloudflare Turnstile.
No card data
//05Payments run through Stripe. Card numbers never reach our systems.
Consent by design
//06Explicit, per-channel opt-in, and only the data a program needs, asked for when it is earned.
Certified infrastructure.
Partner | What it runs for us | Their certifications |
|---|---|---|
| Cloudflare | File storage, media delivery and bot protection | ISO 27001:2022, ISO 27701, ISO 27017, ISO 27018, SOC 2 Type II, PCI DSS 4.0, FedRAMP High, EU Cloud Code of Conduct |
| Amazon Web Services | Augmento's Main hosting, database, file storage and sign-in | ISO 27001, SOC 1, SOC 2 and SOC 3, PCI DSS Level 1 |
| Stripe | Payments | PCI DSS Level 1 service provider, SOC 1 and SOC 2 |
Privacy law.
Explicit and opt-in
Consent is explicit and opt-in, as the EU's GDPR and the UAE's PDPL require.
Brazil and California
Their rules on consent, access and deletion, followed.
Where data lives
Mostly in the United States, with the partners in the table above.
Documents on request.
The DPA, for your program
Sent on request, with the processing details for your program.
Every third party, published
Everyone who processes data for us.
Privacy policy
Send us yours
Security questions
No, and we will not claim to be. Our infrastructure partners hold those certifications, as listed above, and we walk your team through our own controls when you ask.
Mostly in the United States, with the infrastructure partners listed above. Every provider and its processing region is listed at augmento.com/subprocessors.
Access is limited to the team running your program, through role-based accounts.
At augmento.com/request-user-data, or by writing to hello@augmento.com.
Email hello@augmento.com with your company name and program, and we will send it.
Talk to us about security.
Send your questionnaire or ask for the DPA. We reply from an augmento.com address, usually within two business days.
