Enterprise-grade security
Autobound processes signal data for thousands of companies. We treat your data with the same rigor we'd expect for our own.
SOC 2 Type II
Independent auditors test our security controls against the SOC 2 Security criteria. Contact us with questions about our controls.
GDPR and DPAs
Many of our customers are GDPR compliant and use Autobound data under their own GDPR programs. We sign data processing agreements (DPAs) with all enterprise customers.
Security Practices
How we protect your data
How we protect the Signal API, the portal and your data today.
Data Protection
Encryption in Transit
All traffic to the Signal API and the portal uses HTTPS. Plain HTTP requests redirect to HTTPS, and HSTS is on.
Encryption at Rest
Google Cloud encrypts the data we store (Cloud SQL, Firestore, Cloud Storage and BigQuery) at rest with AES-256 by default, with keys that Google manages and rotates.
Data Isolation
Each customer's API keys, request logs and settings belong to its own workspace. Enterprise customers can request dedicated infrastructure.
Data Retention
Signal data is retained per your plan terms. Under our MSA, we delete customer data within 30 days after the agreement ends, and you can ask for an export before then.
Access & Authentication
API Key Authentication
Every API call needs an API key. Each key belongs to one workspace and has its own rate limit. You can create several keys and revoke any key at any time, so you can rotate keys without downtime.
Portal Sign-In
You sign in to the portal with your email and password, and new accounts verify their email address first. AI tools connect to our MCP server through OAuth, and you can disconnect each one in the portal.
Enterprise SSO
SAML-based single sign-on (SSO) is available for enterprise customers.
Role-Based Access Control
Each workspace has four roles: Owner, Admin, Member and Viewer. Only owners and admins can invite members and manage all keys. Viewers can see usage but cannot create keys.
Request Logs
We log every API request with its endpoint, status, credits used and time, and we log API key changes. You can view your request logs in the portal and export them as CSV.
Infrastructure
Cloud Infrastructure
The Signal API, the portal and our databases run on Google Cloud (Cloud Run, Cloud SQL, Firestore and Cloud Storage) in US regions. Deploys run through Cloud Build from configuration in version control.
Backups
The production database has automated backups and point-in-time recovery.
Availability Monitoring
Uptime checks from several regions test the API around the clock. Alerts page the team on downtime, error spikes and slow responses.
Database Access
No external networks are authorized to connect to the production database. Our services reach it through the Cloud SQL connector, which checks IAM credentials.
Monitoring & Response
Continuous Monitoring
24/7 automated monitoring with alerts on API errors, signup abuse and unusual bulk pulls by a single account. Google Security Command Center scans our cloud setup for risky settings.
Penetration Testing
Annual third-party penetration testing with remediation tracking. Enterprise customers can conduct their own assessments with prior coordination.
Vulnerability Management
Dependabot checks our dependencies for known vulnerabilities, and secret scanning runs on every pull request. A build with a critical npm vulnerability fails and does not deploy. Critical vulnerabilities patched within 24 hours.
Incident Response
Documented incident response plan with defined severity levels, response targets, escalation contacts, and post-incident review process. 1-hour acknowledgment SLA for critical issues.
Companies trust Autobound
Security breaches
Questions about security?
Our team is happy to answer questions about our SOC 2 Type II controls, sign a DPA, or schedule a security review call.