Customer feedback is sensitive. We treat it that way.
Below is what's in place today and what's on our roadmap, without certifications we don't hold.
Encryption everywhere.
TLS in transit. Integration credentials, such as your store connection, are encrypted with AES-256-GCM. Each organization's data is kept separate from every other.
Identity + access.
Sign in with email or Google via Firebase Authentication. Team members get roles, and staff access to production data is limited. SAML, SSO and SCIM are on our roadmap.
You own your data.
Your customer data is yours. Export it whenever you like, and we delete it when you leave. We never sell it.
Questions answered plainly.
Want to know where your data is hosted, how it's backed up or who can see it? Email security@informly.co and you'll get a straight answer from the team.
Incidents, told straight.
If something goes wrong that affects your data, we tell you what happened and what we did about it. Our incident response policy is public.
Privacy by design.
Built with GDPR in mind. We collect only what the product needs and honour access and deletion requests from you and your customers.
Where we stand, honestly.
We're pre-launch, so we won't claim certifications we don't hold. Here's exactly where we are today and where we're going.
- SOC 2 Type IIOn our roadmap
- ISO 27001On our roadmap
- GDPRBuilt with it in mind
- PCI DSSOut of scope (Stripe handles card data)
Found a vulnerability? We owe you a thank-you.
Email security@informly.co . We reply to every report, fix what's real, and credit researchers (with permission) once a fix ships.