Security

Semogram runs on managed cloud hosting and database providers. Data is encrypted in transit and at rest using the encryption those providers supply.

Each customer's data is kept separate from other customers' data, with access rules enforced at the database layer. Credentials are stored separately from application data.

Internal access to production systems is limited to the people who need it to run the service, and is removed promptly when their role changes.

We follow OWASP guidance for web application security and track known vulnerabilities in the software we depend on.

If we become aware of a security incident affecting your data, we will investigate it promptly and notify affected customers without undue delay, and as required by applicable law such as the GDPR.

If you discover a security vulnerability, please report it responsibly to security@semogram.com. We appreciate the security research community and will acknowledge valid reports promptly.