Trust & Compliance

Built on EU infrastructure. Encrypted end-to-end. Audited at every layer.

A single landing page for security teams running diligence on OKRs Tool. What's true, where data lives, and which certifications you inherit by using us.

OKR data stored in the EU AES-256 + TLS 1.3 SAML SSO + 2FA GDPR compliant

Data & privacy

Where your data lives, how it's encrypted, and what you can do with it.

EU data residency
All customer OKR content is stored in AWS Ireland (eu-west-1) — your core workspace data does not leave the EU. A small number of sub-processors (e.g. billing, AI, analytics) process limited data outside the EU under SCCs — see our sub-processor list.
Encryption at rest
AES-256 — applied to every byte of customer data on disk.
Encryption in transit
TLS 1.2 / 1.3 on every connection. Older protocols disabled.
GDPR compliant
Full GDPR alignment including lawful basis, retention controls, and sub-processor disclosure.
Right to erasure
Hard delete of your organisation's data on request — no soft-delete window. Everything is removed, audit logs included.
Right to portability
Personal JSON export, org-level Excel export (OKRs, check-ins, users), audit log CSV, and full REST API.

Application security

Controls applied inside OKRs Tool — per-user, per-org, per-request.

Two-factor authentication
TOTP-based 2FA — optional per user, or enforced org-wide by admins.
Row-level isolation
Row Level Security on every customer-data table — each organisation's data is fully isolated at the database layer.
Scoped API keys
API keys scoped per org with full request logging on every call.
Webhook signature verification
Inbound webhooks verify cryptographic signatures, and OAuth integration callbacks use signed state to prevent forgery.
Service role isolation
The service role key never reaches the browser. Only backend processes hold privileged credentials.
MFA step-up enforcement
AAL1 / AAL2 session levels — sensitive actions can require fresh MFA re-authentication.

Access controls

How sign-in, roles, and sessions are managed across your org.

SAML 2.0 SSO
On the Expand plan. Supports Entra/AAD, Okta, Google Workspace, and any SAML 2.0 IdP.
Role-based access
Four roles — Admin, Manager, Member, Viewer. Permissions scoped per workspace and per team.
Org-enforced MFA
Admins can require MFA across the whole org — users without 2FA are blocked from the app until they enrol.
Session management
1-hour JWT, 30-day refresh token. Tokens rotate on use, revoke on sign-out, and expire on inactivity.
Session timeout
Admin-configurable idle and absolute limits — auto sign-out org-wide, including SSO users, or set to never to keep sessions open until sign-out.

Audit & compliance

Every meaningful action recorded, retained indefinitely, exportable on demand.

Full audit log
Every OKR, KR, check-in, review, member change, role change captured with actor and timestamp.
Indefinite retention
Audit log entries are kept for the life of your account — full org history available for compliance review.
CSV export
Export the audit log to CSV with a date range picker — ready for security questionnaires or board reviews.
Inherited certifications
OKRs Tool inherits SOC 2, ISO 27001, PCI DSS from our infrastructure providers — listed in the next section.

Responsible AI

How AI features handle your data — governed by a documented AI Policy.

Human in the loop
AI output is an editable suggestion you review and confirm — never an automatic decision.
No training on your data
Content sent to power AI features is not used to train models and is not shared across accounts.
Data minimisation
Only the content needed to generate a requested output is sent, per request — not retained as a separate AI store.
Vetted AI provider
AI features are delivered through a vetted, contractually bound provider — listed on our sub-processor page.
Inherited certifications

The vendors powering OKRs Tool.

OKRs Tool inherits compliance certifications from the providers below. Every layer of our stack — from network edge to payments — is run on certified infrastructure.

Cloudflare
Network edge, DDoS protection, WAF
SOC 2 Type IIISO 27001
AWS
Compute, storage, regional hosting (EU)
SOC 1SOC 2SOC 3ISO 27001PCI DSS
Supabase
Database, auth, real-time sync
SOC 2 Type II
Stripe
Payments and billing
PCI DSS Level 1
Resend
Transactional email delivery
SOC 2 Type II
Read the details

Trust documents.

Each of these is a standalone page covering its topic in depth — for procurement teams and security questionnaires.

Security overview

How we protect data at every layer.

GDPR

Data subject rights and EU compliance.

Sub-processors

Every vendor that touches your data.

Privacy policy

What we collect, how we use it.

Cookie policy

What cookies we set and why.

Terms of service

The legal terms covering your use.
Available on request

Documents for your vendor review.

If you're going through a procurement or security review, email Steven to request any of the following — we typically respond within one business day.

  • Information Security Policy, Incident Response Plan, AI Policy & Records Retention Policy — our core internal policy set, available under NDA.
  • Signed DPA (Data Processing Agreement) — standard GDPR template ready to countersign.
  • Security questionnaire — we'll fill out yours, or share our standard answers (SIG Lite, CAIQ, etc.).
  • Sub-processor change notifications — subscribe to be notified before any sub-processor is added or changed.
  • Infrastructure compliance reports — copies of SOC 2 and ISO 27001 reports from our infrastructure providers, under NDA.