Security & Trust
SafeGora serves OSHA-regulated employers, safety consultants, auditors, and carriers. This page consolidates how we protect customer data, where it lives, who else processes it, and how to reach our security team. For the public Trust Center entry point, see /trust.
How we protect your data
The controls on every plan.
Infrastructure security
Hosted on Google Cloud Platform with VPC-native networking, Cloud Armor WAF, and automated patching. Primary application data is stored in us-west1.
Encryption everywhere
256-bit AES encryption at rest for all data. TLS 1.3 in transit. Database connections are SSL-enforced with certificate verification.
Tenant isolation
PostgreSQL row-level security (RLS) enforces strict tenant boundaries at the database layer. No application-level workarounds — the database engine enforces the isolation.
Access controls
Role-based access with owner, admin, manager, and member tiers. Sign-in is handled by WorkOS; session tokens rotate automatically.
Audit trail
Every data mutation is logged with actor, timestamp, and before/after state. Audit logs are designed for controlled retention and review in regulated workflows.
Compliance & certifications
SOC 2 Type II audit in progress with a target of H1 2027; ISO 27001 evaluation targeted for 2027. Privacy controls are designed to support regulated employer workflows. The certifications roadmap and DPA / BAA posture are set out below.
Account controls
These points match the WorkOS row on /legal/subprocessors.
- Sign-in methods listed for WorkOS: password, Magic Auth, and social OAuth.
- Those three methods are the full sign-in list. SafeGora does not add another sign-in step.
- Enterprise SSO (SAML/OIDC) via WorkOS: planned and deferred.
Data residency
SafeGora's primary application data plane — Cloud Run, Cloud SQL, Cloud Storage, and Cloud Logging — is in Google Cloud us-west1 (United States). The sub-processor list does not name a backup geography.
| Service | Geography | Status |
|---|---|---|
| Application storage (Cloud SQL and Cloud Storage) | us-west1 (United States) — primary data plane | Listed under Google Cloud Platform |
| Backups | not disclosed | Not named on the sub-processor list |
| Logs (Cloud Logging and Cloud Monitoring) | us-west1 (United States) — primary data plane | Included in the Google Cloud Platform entry |
| Email (Google Workspace SMTP) | United States (Google Workspace / GCP agreements) | Listed |
| Text AI | Vertex AI global endpoint. Google can serve a request from any of its regions; this is not a United States-only commitment. | Listed on the Vertex AI / Gemini entry |
| Embeddings | Vertex AI us-west1 (United States). | Listed on the Vertex AI / Gemini entry |
| Image AI | not disclosed | Document, vision, and voice paths are named in the AI service description. The location text does not give image AI its own geography. |
| WorkOS authentication | United States | Listed |
| Stripe billing | United States | Listed |
| Cloudflare DNS | Global DNS edge; no claim of Customer data residency on Cloudflare compute | Listed. Open item: a signed Cloudflare DPA is not yet confirmed on file. |
The sub-processor list does not name EU, UK, Canada, or APAC residency. If your procurement requires it, contact Ollie@safegora.com.
Sub-processors
SafeGora contracts with a small set of sub-processors to deliver the service (cloud infrastructure, identity, billing, communications). The full public list with categories of Personal Data Processed, processing location, and 30-day change-notification commitment is published at /legal/subprocessors.
Data Processing Addendum (DPA)
Every customer receives the baseline data-processing terms in section 10 of the Terms of Service. Enterprise customers can also execute a Data Processing Addendum with their agreement; /legal/dpa describes that process. A public fill-in-the-blank template is not published there. Request an executable copy or submit redlines at Ollie@safegora.com.
Business Associate Agreement (BAA)
SafeGora is not a HIPAA covered entity or Business Associate today. Customers with protected health information (PHI) exposure should treat SafeGora as outside the BAA boundary and should not upload PHI into the platform. If your safety program intersects with PHI handling, contact us so we can scope an appropriate path forward.
Vulnerability disclosure
We welcome reports from security researchers. Send findings to Ollie@safegora.com. Our machine-readable contact is published at /.well-known/security.txt per RFC 9116.
We follow a 90-day coordinated disclosure window from initial triage to public acknowledgement. We will not pursue legal action against researchers who:
- Make a good-faith effort to avoid privacy violations, data destruction, or service interruption.
- Give us a reasonable opportunity to remediate before public disclosure.
- Do not exploit findings beyond what is necessary to confirm them.
- Refrain from social engineering, physical attacks, and denial-of-service testing against production.
Status page
Current incident status is handled by the on-call team. See /status — that page is not a third-party status network, and no public status hostname is in production yet. When something looks wrong, email Ollie@safegora.com with the workspace, the time you first saw the issue, and what you were trying to do.
Certifications roadmap
SafeGora does not hold a third-party security attestation today. Active engagements:
- SOC 2 Type II — audit in progress; attestation target H1 2027. Type 1 issuance precedes Type 2 by the evidence-period boundary; both will be available under NDA on request once issued.
- ISO 27001:2022 — evaluation begins after SOC 2 Type II issuance; certification target 2027.
- HIPAA / BAA — not in scope today (see "Business Associate Agreement" above).
- FedRAMP / StateRAMP — tracked as a follow-on after ISO 27001; no committed date.
Buyers in active procurement can request our written security packet, or ask to be notified when SOC 2 Type 1 issues, by emailing Ollie@safegora.com. The marketing claims on this page reflect what currently ships, not aspirational posture.
Contact
Security and trust inquiries: Ollie@safegora.com. Privacy and data-subject requests: Ollie@safegora.com. Legal and contract: Ollie@safegora.com.