# Trust center How Inth runs security and privacy: the audits we are preparing for, the policies and controls behind them and the vendors we use. Request the full documents for your security review. [Request documents](#request) ยท [Report a security issue](/security) ## Frameworks The audits Inth is working towards. We do not hold a SOC 2 report yet; a status changes only when an auditor issues one. - SOC 2 Type 1: In progress. An auditor tests whether controls are designed correctly at one point in time. - SOC 2 Type 2: In progress. An auditor tests whether controls operated as designed over a review period. ## Policies 25 policies The written policies behind our security programme. We can share the full text under a mutual NDA. - Acceptable Use & Workstation Security - Access Control & Least Privilege - Authentication & Password - Background Screening & On/Off-boarding - Backup, Business Continuity & Disaster Recovery - Change & Release Management - Compliance & Regulatory Monitoring - Data Classification & Handling - Encryption & Crypto Controls - Incident Response & Breach Notification - Information Security & Privacy Governance - Information Sharing & Transfer - Logging, Monitoring & Audit - Physical Security & Environmental - Policy Management & Exception Handling - Privacy & Data-Subject Rights - Remote Access & BYOD - Retention & Secure Disposal - Risk Management - Sanctions & Disciplinary - Secure Configuration & Hardening - Secure Software Development Lifecycle - Security & Privacy Awareness Training - Vendor & Third-Party Risk - Vulnerability & Patch Management [Request the policies](#request) ## Controls 35 controls The controls in our security programme, tracked in Comp AI, our compliance platform. Listing a control does not mean an auditor has tested it; the SOC 2 audits above will do that. **Access and identity** - Access Rights - Credential Management - Segregation of duties - Physical Access Control - Remote-Work Security **Data protection** - Data Privacy - Data Retention & Destruction - Encrypted Data at Rest - Encryption Key Management - Information Classification - Secure Data Transfer **Infrastructure and endpoints** - Asset Inventory - Configuration & Patch Management - Endpoint Protection - Endpoint Security - Network Security - Resource Capacity Management **Operations and response** - Change management - Secure SDLC Integration - Standard Operating Procedures (SOPs) - Vulnerability Management - Security Logging - Security Monitoring & Detection - Security Incident Management - Disaster Recovery Planning **Governance and risk** - Management Security Accountability - Organization Structure & Reporting Lines - Policy Compliance - Regulatory Liaison - Risk Management - Security Governance Roles **People and suppliers** - Personnel Security - Disciplinary process - Acceptable Use - Supplier Security ## Subprocessors 22 subprocessors The third parties that process customer data on our behalf to run Inth, each linked to its own trust or security page where one exists. Our DPA governs how we add or change subprocessors; this list reflects them as of 20 October 2026. - [Vercel](https://security.vercel.com/): Hosting for the Inth service. - [PlanetScale](https://trust.planetscale.com/): Databases for the hosted service. - [ClickHouse](https://trust.clickhouse.com/): Request analytics and platform telemetry for the hosted service. - [Upstash](https://trust.upstash.com/): Infrastructure for the hosted service. - Unkey: Infrastructure for the hosted service. - [Turso](https://trust.turso.tech/): Infrastructure for the hosted service (legacy). - [Sentry](https://sentry.io/trust/): Error monitoring. - [Axiom](https://trust.axiom.co/): Traces and logs from product and CLI telemetry. - [WorkOS](https://trust.workos.com/): Authentication, single sign-on and directory sync. - [Resend](https://resend.com/security): Email delivery. - [Stripe](https://docs.stripe.com/security): Payment data. Its role depends on the activity. - [Autumn](https://trust.useautumn.com/): Billing orchestration on top of Stripe. - [Attio](https://trust.attio.com/): CRM for customer records, sales and onboarding. - [PostHog](https://trust.posthog.com/): EU. Product analytics. - [Databuddy](https://www.databuddy.cc/docs/security): Website analytics. - [incident.io](https://trust.incident.io/): Status page tooling. - [Kernel](https://trust.kernel.sh/): Browser automation, where features require it. - [Exa](https://trust.exa.ai/): Research APIs used for signup enrichment. - [Anthropic](https://trust.anthropic.com/): AI model provider through our AI gateway, with zero data retention for covered routes. - SpaceXAI: AI model provider through our AI gateway, with zero data retention for covered routes. - [OpenAI](https://trust.openai.com/): AI model provider. - [Slack](https://slack.com/trust): Internal messaging when staff handle support or sales. Customer content may appear if included in messages. ## Legal documents Our standard public terms. If you have a signed agreement or DPA with us, it takes precedence. - [Privacy policy](/legals/privacy-policy) - [Terms and conditions](/legals/terms-and-conditions) - [Cookie policy](/legals/cookie-policy) ## How access works - Send the request: Tell us what you need. We review each request and may ask a few questions first. - Sign the NDA: If we approve your request, we email you a link to a mutual NDA. - Get the documents: Once the NDA is signed, we share the documents we can make available for your review. ### Is Inth SOC 2 audited? No. We do not hold a SOC 2 report yet. We are working towards SOC 2 Type 1 and Type 2, and the frameworks above show where each one stands. We will update this page when a report is issued. ### How do I get the policies? Send a request with the form on this page. If we approve it, we email you a mutual NDA to sign and then share the policies. ### Will you fill in our security questionnaire? Usually, yes. Tick "Answer our security questionnaire" in the form and tell us the format and the deadline. We reply from security@inth.com, and may point you to our standard answers. ### Where does Inth host customer data? The hosted service runs on Vercel, with data stored by providers including PlanetScale and ClickHouse. Data may be processed in the United States and other countries where we or our providers operate. The subprocessor list on this page and the privacy policy name the providers, and the DPA sets out the transfer safeguards we use. ### How do I report a vulnerability? Use the security report form at inth.com/security, or email security@inth.com. Do not include passwords, keys or customer data. Please allow us reasonable time to fix a confirmed issue before disclosing it publicly. This page describes our security programme for information only. It is not part of any contract and may change without notice. Our commitments are set out in your agreement with us and our DPA. Last updated: 20 October 2026.