Frameworks
The audits Inth is working towards. We do not hold a SOC 2 report yet; a status changes only when an auditor issues one.
SOC 2 Type 1
An auditor tests whether controls are designed correctly at one point in time.
SOC 2 Type 2
An auditor tests whether controls operated as designed over a review period.
Policies
The written policies behind our security programme. We can share the full text under a mutual NDA.
- Acceptable Use & Workstation Security
- Access Control & Least Privilege
- Authentication & Password
- Background Screening & On/Off-boarding
- Backup, Business Continuity & Disaster Recovery
- Change & Release Management
- Compliance & Regulatory Monitoring
- Data Classification & Handling
- Encryption & Crypto Controls
- Incident Response & Breach Notification
- Information Security & Privacy Governance
- Information Sharing & Transfer
- Logging, Monitoring & Audit
- Physical Security & Environmental
- Policy Management & Exception Handling
- Privacy & Data-Subject Rights
- Remote Access & BYOD
- Retention & Secure Disposal
- Risk Management
- Sanctions & Disciplinary
- Secure Configuration & Hardening
- Secure Software Development Lifecycle
- Security & Privacy Awareness Training
- Vendor & Third-Party Risk
- Vulnerability & Patch Management
Controls
The controls in our security programme, tracked in Comp AI, our compliance platform. Listing a control does not mean an auditor has tested it; the SOC 2 audits above will do that.
Access and identity
- Access Rights
- Credential Management
- Segregation of duties
- Physical Access Control
- Remote-Work Security
Data protection
- Data Privacy
- Data Retention & Destruction
- Encrypted Data at Rest
- Encryption Key Management
- Information Classification
- Secure Data Transfer
Infrastructure and endpoints
- Asset Inventory
- Configuration & Patch Management
- Endpoint Protection
- Endpoint Security
- Network Security
- Resource Capacity Management
Operations and response
- Change management
- Secure SDLC Integration
- Standard Operating Procedures (SOPs)
- Vulnerability Management
- Security Logging
- Security Monitoring & Detection
- Security Incident Management
- Disaster Recovery Planning
Governance and risk
- Management Security Accountability
- Organization Structure & Reporting Lines
- Policy Compliance
- Regulatory Liaison
- Risk Management
- Security Governance Roles
People and suppliers
- Personnel Security
- Disciplinary process
- Acceptable Use
- Supplier Security
Subprocessors
The third parties that process customer data on our behalf to run Inth, each linked to its own trust or security page where one exists. Our DPA governs how we add or change subprocessors; this list reflects them as of 20 October 2026.
Hosting for the Inth service.
Databases for the hosted service.
Request analytics and platform telemetry for the hosted service.
Infrastructure for the hosted service.
Unkey
Infrastructure for the hosted service.
Infrastructure for the hosted service (legacy).
Error monitoring.
Traces and logs from product and CLI telemetry.
Authentication, single sign-on and directory sync.
Email delivery.
Payment data. Its role depends on the activity.
Billing orchestration on top of Stripe.
CRM for customer records, sales and onboarding.
Product analytics.
Website analytics.
Status page tooling.
Browser automation, where features require it.
Research APIs used for signup enrichment.
AI model provider through our AI gateway, with zero data retention for covered routes.
SpaceXAI
AI model provider through our AI gateway, with zero data retention for covered routes.
AI model provider.
Internal messaging when staff handle support or sales. Customer content may appear if included in messages.
Legal documents
Our standard public terms. If you have a signed agreement or DPA with us, it takes precedence.
How access works
Send the request
Tell us what you need. We review each request and may ask a few questions first.
Sign the NDA
If we approve your request, we email you a link to a mutual NDA.
Get the documents
Once the NDA is signed, we share the documents we can make available for your review.
Request trust documents
Tell us what you need for your security review. We aim to reply by email within five business days.
No. We do not hold a SOC 2 report yet. We are working towards SOC 2 Type 1 and Type 2, and the frameworks above show where each one stands. We will update this page when a report is issued.
Send a request with the form on this page. If we approve it, we email you a mutual NDA to sign and then share the policies.
Usually, yes. Tick "Answer our security questionnaire" in the form and tell us the format and the deadline. We reply from security@inth.com, and may point you to our standard answers.
The hosted service runs on Vercel, with data stored by providers including PlanetScale and ClickHouse. Data may be processed in the United States and other countries where we or our providers operate. The subprocessor list on this page and the privacy policy name the providers, and the DPA sets out the transfer safeguards we use.
Use the security report form at inth.com/security, or email security@inth.com. Do not include passwords, keys or customer data. Please allow us reasonable time to fix a confirmed issue before disclosing it publicly.
This page describes our security programme for information only. It is not part of any contract and may change without notice. Our commitments are set out in your agreement with us and our DPA. Last updated: 20 October 2026.