Where we stand, honestly

• PCI DSS Level 1Certified — held by Stripe, our payment processor– Payment processing
• NACHA rulesCompliant (self-assessed)– ACH payments
• GDPRCompliant (self-assessed)– EU data protection
• CCPACompliant (self-assessed)– California privacy

We follow these control frameworks but are not certified.

• SOC 2Aligned — not certifiedWe are not SOC 2 certified but follow controls aligned with SOC 2 Type II (e.g. encryption, access control, audit logging, incident response).
• NIST Cybersecurity FrameworkAligned — not certifiedWe follow NIST CSF–aligned practices across Identify, Protect, Detect, Respond, and Recover (risk identification, access control, encryption, monitoring, incident response).
• CIS ControlsAligned — not certifiedWe align with CIS Controls for security hardening, inventory, access management, and secure configuration.
• ISO 27001Aligned — not certifiedWe are not ISO 27001 certified but follow controls aligned with ISO 27001 (information security management, risk assessment, access control, cryptography).
• PCI DSSAligned — not certifiedPayment card data is processed via Stripe (PCI DSS Level 1); we do not store card data and follow PCI DSS–aligned practices for the systems we control.

For regulatory regimes (GDPR, CCPA, NACHA) and our third-party data processors, see Compliance.

• SOC 2 Type II certificationPlanned
• ISO 27001Planned
• HIPAA compliancePlanned– For healthcare clients
• Third-party penetration testingPlanned

• Automated vulnerability scanningContinuous
• Third-party penetration testingPlanned