Information Security Overview

StickRate maintains an information security program designed to align with SOC 2 Type II criteria. Our program covers organizational security policies, risk management, access controls, vulnerability management, incident response, and vendor due diligence.

Security documentation is available under NDA to qualified enterprise prospects. Contact security@stickrate.io to request access.

The StickRate platform runs on Amazon Web Services (AWS) in the us-east-1 region. AWS maintains a broad set of compliance certifications, including SOC 1/2/3, ISO 27001, and FedRAMP. AWS compliance documentation is available at aws.amazon.com/compliance.

All production services run within a private VPC. The application tier is deployed on ECS Fargate (serverless containers) and communicates with a private-subnet RDS PostgreSQL database. No production database is directly accessible from the public internet.

In transit: All data transmitted between clients and StickRate is encrypted using TLS 1.2 or higher. Internal service-to-service communication within the VPC is also encrypted.

At rest: All data stored in RDS PostgreSQL is encrypted using AES-256. S3 storage uses AWS-managed keys with server-side encryption. Designated sensitive fields are encrypted at the application layer before being written to the database.

Access to production systems follows least-privilege principles. All human access to production infrastructure requires MFA and is authenticated through our identity provider. Production database access follows a role-separation model: application services connect through scoped roles limited to the operations they perform, and administrative and schema-change access is restricted to a dedicated migration role used only during deployments. Direct human access to production databases is limited to authorized personnel.

Customer data is logically isolated by tenant. Tenant isolation is enforced in application code on every customer-data query, scoped to the authenticated tenant. No customer can access another customer's data through the application layer. Security-relevant events, including all API actions on Customer Data, are recorded in append-only audit logs retained in the production database.

We conduct security reviews for all significant code changes. Automated dependency scanning (pip-audit, npm audit) runs on every CI build.

Authentication is handled by Auth0, which provides industry-standard identity management, MFA enforcement, brute-force detection, and anomalous login alerting.

We monitor for new CVEs affecting our dependencies and infrastructure components. Critical and high-severity vulnerabilities are remediated within 7 and 30 days of discovery, respectively. Our CI pipeline blocks deployment of known high-severity vulnerable dependencies.

StickRate maintains a documented incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review. In the event of a confirmed security incident affecting Customer Data, StickRate will notify Customer as described in the Data Processing Agreement at stickrate.io/legal/dpa. To report a suspected security incident, contact security@stickrate.io.

Production database snapshots are taken daily and retained for 7 days. Point-in-time recovery is enabled with transaction logs retained for 7 days. Our target RTO is 4 hours and RPO is 1 hour for declared disasters.

All personnel with access to production systems complete security awareness training and are subject to background checks prior to receiving access. Departing personnel have access revoked within 24 hours of separation.

StickRate conducts security reviews of sub-processors before engagement and periodically thereafter. Our current sub-processor list, including the security certifications held by each, is available at stickrate.io/legal/sub-processors.

StickRate uses large language models (LLMs) for certain features including AI-assisted field mapping, signal extraction, and deal narrative generation. Customer Data sent to LLM providers is processed under data processing agreements that prohibit training on Customer Data. We do not use Customer Data to fine-tune or improve third-party models. LLM provider details are listed in the Sub-Processor List. Certain integrations involve transient processing of email and calendar content, where raw content is processed in memory and immediately discarded. Only extracted structured signals, short evidence phrases, and source references are retained.

We welcome reports from security researchers. If you believe you have found a security vulnerability in StickRate's systems, please disclose it responsibly by contacting security@stickrate.io. We commit to acknowledging receipt within 2 business days and providing regular updates on remediation progress.