Trust
Security, in one page.
How Threadseam is secured, where data lives, and who touches it. Everything on this page is also in our DPA — ask us at security@threadseam.app.
Certifications & frameworks
SOC 2 Type II
Audited by Prescient (Dec 2025)
ISO 27001
In progress; expected Q1 2027
GDPR
DPA on request; EU subprocessors list below
HIPAA
BAA available on Enterprise plan
Data residency
Choose where your knowledge base lives. On Enterprise, you can pin your workspace to a single region; nothing leaves it except transient LLM calls to zero-retention endpoints in that same region.
- us-east-1 (Virginia)
- eu-west-1 (Ireland)
- ap-southeast-2 (Sydney)
Controls
- Encryption
- AES-256 at rest, TLS 1.3 in transit. KMS keys per-workspace, rotated every 90 days.
- SSO & SCIM
- SAML 2.0 (Okta, Azure AD, Google, generic). SCIM for user provisioning on Enterprise.
- Access logs
- Every read of a knowledge entry is logged with user, timestamp, and IP. Exportable to your SIEM.
- Vulnerability disclosure
- Report issues to security@threadseam.app (PGP key at /.well-known/security.txt).
Subprocessors
| Vendor | Purpose | Region |
|---|---|---|
| AWS | Primary compute, storage, networking | US / EU / AU |
| Cloudflare | Edge, DDoS protection, WAF | Global |
| OpenAI (enterprise) | LLM inference (zero-retention) | US |
| Anthropic (enterprise) | LLM inference (zero-retention) | US |
| Postmark | Transactional email | US |
| Linear | Internal issue tracking | US |
We give 30 days' notice before adding or changing subprocessors. Enterprise customers can block changes during the notice window.