Most vendors dress up "coming soon" as "compliant." We don't. Here's exactly what's live today, what's in flight, and what we won't promise until it's real.
TLS 1.3 on every edge. AES-256 at rest on Supabase (Postgres) and object storage. Keys rotate on a 90-day cycle and are never logged.
Every workspace is row-level isolated in Postgres (RLS policies). No shared tables across customers. API keys and OAuth tokens are per-workspace, encrypted with AES-256-GCM in a secrets vault.
Sign in with Google, Microsoft, or GitHub. SAML SSO (Okta, Azure AD, Google Workspace) is included on Growth and higher — no upcharge.
Every action — who did what, when, from where — is logged immutably and exportable as CSV or via webhook. 90-day retention on every plan. 7-year retention on Enterprise.
One click exports everything: your workflows (JSON), your build configs, your pipeline data (CSV + Parquet), your connected CRM snapshots. No lock-in. You can walk any day.
Hard spend caps per workspace, per user, per workflow. Anomaly alerts fire on 3× baseline. Global kill switch halts every outbound action from the admin panel. No surprise bills.
Type I report complete with Vanta. Type II observation window is in progress — report expected Q3 2026. Under NDA we'll share the current auditor's interim letter and the full Vanta control list.
Infrastructure is HIPAA-aligned (encryption, access controls, audit logs, tenant isolation). BAA available on Enterprise once Type II lands. Medical, dental, med-spa, vet — email us if you need it sooner and we'll work with you.
We target three nines on Growth and higher. Our 90-day rolling availability has been 99.94% since launch. Contractual SLA with credits is on the Enterprise plan.
We don't touch card data. Payments route through Stripe (PCI Level 1). If your workflow accepts cards, they go direct to Stripe — never through our systems. Formal SAQ-A attestation Q4 2026.
DPA available now. Subprocessor list is public (below). Right-to-delete is one-click in your workspace settings. Formal GDPR data residency (EU-only processing) is Q4 2026.
Annual third-party pen test (NCC Group) scheduled Q3 2026. Public bug bounty on HackerOne opens alongside. Meanwhile, security@mainframe.ai gets a response within 24 hours.
We won't put "SOC 2 Compliant" on a webpage before the Type II report is in our hands. We won't sign a BAA without the underlying controls attested. We won't claim "FedRAMP" or "HITRUST" — we're not there.
If that disqualifies us for your procurement today, we respect it. Check back in Q3 2026, or start on a non-regulated workflow now and flip on compliance features when they land.
If you need something specific — a BAA, EU residency, a custom DPA, an on-prem option — email trust@mainframe.ai. We read every one.
Current Vanta control list, pen test letter, subprocessor DPAs, SSO setup — we'll send it all under NDA.
Email trust@mainframe.ai