Security

MatterMore is SOC 2 certified. An independent auditor has assessed our controls against the AICPA Trust Services Criteria for security.

Our leadership owns the security program, including our policies, risk assessments and control monitoring. We review our policies at least once a year and run a formal risk assessment every year. We also review the audit reports of the providers we rely on, including Google Cloud, each year.

Security documentation is available on request.

We host on Google Cloud Platform. BigQuery is our data warehouse, Cloud Storage holds files, and our data pipelines run on Kubernetes. Google secures the data centers, which are staffed and monitored around the clock.

Each customer's data sits in its own single-tenant warehouse and is never mixed with another customer's data. Our network is segmented and protected by firewalls, and the application accepts only HTTPS connections. If a component fails, it is replaced automatically, so the service keeps running.

We encrypt data in transit with TLS and encrypt it at rest. Every endpoint is HTTPS only, and backups are encrypted too.

Names, emails and employee IDs are hashed at ingestion, so they never reach storage in readable form.

Access follows least privilege. Only named engineers can reach production, and only with multi-factor authentication. Roles are split into admin, user and no-access, and we review every user's access at least once a year.

When someone leaves MatterMore, we remove their access within three business days. Audit logs are enabled and reviewed.

Every code change is peer reviewed, tested and approved before it reaches production. We develop and test in environments kept separate from production.

Our change process is documented, and every change is tracked in a ticket. Version control keeps a full history, so we can trace any change and roll it back.

We run weekly automated scans of our production environment for known threats and misconfigurations. We also scan our code and its open-source dependencies for vulnerabilities.

High-risk findings are fixed first, against defined timelines. A third party tests our external defenses every year through penetration testing.

We back up customer data in Google Cloud. Backups are encrypted, and only key personnel can access them.

We monitor every backup and rerun any that fails. We also monitor the application, its databases and its storage.

Everyone at MatterMore passes a background check before they join. Each person completes security training within 30 days of starting and again every year.

Company laptops are encrypted, monitored and kept to secure configuration standards.

We keep a documented incident response plan. It sets out how we identify, report and act on security and privacy incidents.

We notify you of any breach involving your data within 48 hours of discovery. We log and track every incident, and we change our procedures when an incident calls for it.