Your schedule holds your people's data. Here's how we look after it.
What's in place, what's in progress and what isn't built yet, for whoever reviews software at your company.
Last reviewed 12 October 2026
- In placeAWS, Ireland
Your database in eu-west-1, with backup copies in Frankfurt.
- In placeTLS 1.2+ and AES-256
In transit to Soon, and at rest.
- In placeTwo-step and SSO
Two-step verification with an authenticator app. SSO and SCIM on Enterprise.
- In our DPAA DPA for everyone
48-hour breach notice, sub-processors listed.
- DonePenetration test
Independent, of production, September 2026.
- In progressSOC 2 Type 1
Audit under way. No report yet.
Where your data is processed.
EU
- AWS, IrelandYour database, with backup copies in Frankfurt
- Redis Cloud, FrankfurtRate limits and job queues
- PostHog, FrankfurtProduct analytics, after sign-in, no recordings
United States
- SentryError reports, without email or IP address
- IntercomSupport chat
- OpenAIThe AI assistant
- WorkOSSingle sign-on, Google and Microsoft sign-in
Worldwide
- CloudflareThe app's pages
- StripePayments, EU and US
Also in our DPA, each with its location and transfer safeguard: Amazon SES, Cloudinary, Google Maps Platform, Google Workspace, Slack. The standard service doesn't offer a choice of region.
What protects your team's data.
Single sign-on
EnterpriseSAML or OIDC through your identity provider, enforced if you choose.
Directory sync
EnterprisePeople join and leave Soon with your directory. Never deleted.
Roles and board access
Owner, admin and member; edit, view or no access on each board.
Logs
Access changes, sign-in links and deactivations, per person.
Privacy settings
Hide email addresses. Share links are read-only, can take a password, and can be revoked.
Passwords
Stored only as a salted hash, with repeated attempts slowed down.
Owners and admins
On a paid plan or the trial, and never beyond their own access.
Approval to publish
In Soon's assistant, publishing, closing and deleting always wait for you. Nothing reaches your team until a person publishes it.
Names as IDs
In day planning, the names you tag go to the AI as internal IDs.
OpenAI, in the US
A sub-processor in our DPA. API data isn't used to train its models by default.
Our Terms
We don't use your content to train models for other customers.
An off switch
On requestAI, support chat and identifying error data off for your whole team.
A private database
No public endpoint, and every engineer session is logged.
Our own audit trail
Organisation-wide AWS logs, kept in a separate account.
Backups
Daily automated backups, encrypted, kept 30 days, with point-in-time recovery.
The web app
A content security policy, no framing, sign-in cookies scripts can't read.
Our code
Two-factor required for everyone in our GitHub organisation.
What's been checked, and by whom.
- An independent penetration test of the production web app and its API, September 2026. The report is confidential.
- Breach notice within 48 hours
- Data-subject requests within five working days
- 30 days' notice of a new sub-processor
- Your data to export for 30 days when you leave, then deleted
- Reports and questionnaires, then an inspection if needed
- SOC 2 Type 1, security criteria: the audit is under way.
- ISO 27001: our security management system is built on it. Certification is planned.
- AWS's own certifications cover the AWS services Soon runs on. They're AWS's, not ours.
What reviewers ask. Answered plainly.
Not yet. A SOC 2 Type 1 audit of our security controls is under way, and the report date is the auditor's to set. Our security management system is built on ISO 27001, and certification is planned. We'll update this page when either changes.
Your database is on AWS in Ireland, with backup copies in Frankfurt. Rate limits and job queues run on Redis Cloud in Frankfurt. Some services we use process data in the United States, each listed in our DPA with its transfer safeguard. The standard service doesn't offer a choice of region.
Yes. If you sign in with an email and password, you can turn on two-step verification with an authenticator app, with recovery codes in case you lose your phone. Google, Microsoft and single sign-on use your provider's own second factor.
Ours applies automatically through our Terms. We can also agree a DPA of your own, which then takes precedence.
Yes. Send it to security@soon.works.
Under our DPA, you can export it for 30 days after your contract ends. It's then deleted from our live systems within a further 60 days, and from backups within 30 days after that.
Reviewing Soon for your company?
Send your questionnaire or ask for our security documents.
Report a vulnerability
Email security@soon.works with what you found and how to reproduce it.