Security · BaristaGrid

We design BaristaGrid to be secure by default. Every feature is reviewed for data exposure, every change ships through a peer review, and every production environment is monitored continuously for anomalous behavior.

1. Infrastructure

Hosted on hardened, SOC 2 Type II audited cloud infrastructure with isolated production environments.
All traffic is encrypted in transit using TLS 1.2+ with modern cipher suites and HSTS preload enabled.
Customer data is encrypted at rest using AES-256, and database backups are encrypted and replicated across availability zones.
Secrets are managed through a centralized vault with strict IAM policies and full audit logging.

2. Identity & access

Single sign-on via Google and SAML providers (available on Business and Enterprise plans).
Role-based access control inside every workspace, with a documented least-privilege model.
Mandatory two-factor authentication for all BaristaGrid employees and contractors with production access.
Background checks and confidentiality agreements for everyone who handles customer data.

3. Application security

Our engineering team follows secure development lifecycle practices — including threat modeling, dependency scanning, static analysis, and mandatory code review. We engage independent security firms to perform penetration tests at least annually and after significant architectural changes.

4. Monitoring & incident response

A 24/7 monitoring stack watches the platform for performance anomalies and suspicious activity. We maintain a published incident response plan, run tabletop exercises quarterly, and commit to notifying impacted customers without undue delay in the event of a confirmed security incident.

5. Compliance

GDPR-aligned data processing terms, available on request.
CCPA / CPRA compliant — including verifiable consumer rights workflows.
Annual SOC 2 Type II reports available to customers under NDA.
Sub-processor list is reviewed quarterly and published for transparency.

6. Reporting a vulnerability