01
SOC 2 Type II
Audit in progress (Q3 2026). Controls for access, change, and monitoring.
Company · Security
Security that doesn't slow you down
SOC 2, GDPR-ready, RBAC, and data residency.
We built Pegalio for regulated industries from day one. SOC 2 Type II in progress, GDPR with DPA and subprocessors list, and self-host for teams that don't ship data outside.
02
GDPR and DPA
Ready DPA, subprocessors list, EU data residency on Business+.
03
RBAC and audit log
16 system roles, 50+ permissions, audit log on every CUD operation.
04
SSO and MFA
OIDC, SAML, and mandatory MFA for admin roles.
05
Encryption
TLS 1.3 in transit, AES-256 at rest. Keys held in KMS.
06
Self-host
Full feature parity with hosted. Docker image for AWS/GCP/on-prem.
Subprocessors
Pegalio engages the following third parties to deliver the service. Customers can subscribe to subprocessor change notifications via [email protected].
ProviderPurposeLocation
Amazon Web Services (AWS)Primary cloud hosting (RDS, S3, ECS)us-east-1 / eu-west-1
Stripe, Inc.Payment processing and billingUnited States
ResendTransactional email deliveryUnited States
Anthropic, PBCAI features (Claude API)United States
CloudflareDNS and edge cachingGlobal
SentryError monitoringUnited States
Trust & compliance documents
Email [email protected] to request these documents under NDA. We respond within 2 business days.
- Data Processing Agreement (DPA)
- Privacy Policy
- Sub-processor change log
- SOC 2 Type II report (in progress)
- Penetration test summary
Vulnerability disclosure
Found a security issue? Email [email protected]. We acknowledge reports within 24 hours and target fixes for critical issues within 7 days. We don't pursue legal action against good-faith research conducted under our disclosure policy.
Incident response
Customer-impacting incidents trigger an in-app status banner, an email to workspace admins within 4 hours of confirmation, and a public post-mortem on /status within 5 business days.