Trust Center

Start here

• Secure by Design progress — a versioned engineering draft with source references and remaining evidence for each of the seven goals.
• Security overview — encryption, tenant isolation, audit logging, certifications roadmap, and responsible disclosure.
• Sub-processors — public list of vendors that process customer data, with categories and change-notification commitment.
• Data Processing Addendum — how enterprise customers execute a DPA with their agreement. Not a signed contract; a public fill-in-the-blank template is not published.
• Service Level Agreement — uptime and credit scaffold for enterprise review.
• Accessibility — WCAG 2.2 Level AA target; accessibility assessment is in progress and no completed ACR/VPAT has been issued.
• Service status — scoped availability observations, our public incident-history policy and a dated retrospective entry.

Operator, company stage and support contact

SafeGora is operated by OllieLabs LLC, as identified in our published terms and privacy policy. SafeGora does not yet publish customer references or customer outcomes. Public examples and internal validation records are not customer references or measured customer outcomes.

For product, implementation, account and procurement questions, email Ollie@safegora.com. Privacy, security and legal contacts are listed in the privacy policy. Confirm support coverage and any contractual response commitments before rollout; no support staffing or round-the-clock coverage is established by this page. The publication owner is named on the public incident history.

Data residency

SafeGora's primary application data plane — Cloud Run, Cloud SQL, Cloud Storage, and Cloud Logging — is in Google Cloud us-west1 (United States). The sub-processor list does not name a backup geography. Full row-by-row detail is on /security. Procurement teams may request the internal residency declaration via Ollie@safegora.com.

Data Processing Addendum (DPA)

Enterprise customers execute a Data Processing Addendum with their agreement. /legal/dpa describes that process — it is not a signed contract, and a public fill-in-the-blank template is not published there. Request an executable copy or submit redlines at Ollie@safegora.com.

Sub-processors

SafeGora uses a small set of sub-processors (cloud infrastructure, identity, billing, communications). The authoritative public list — including categories of personal data processed, processing location, and a 30-day change-notification commitment — is at /legal/subprocessors.

Support access and break-glass

Customer support prefers guided screen-share without operator impersonation. When tenant impersonation is required, it is limited to platform operators on a company email domain, rate-limited, and written to a platform audit log (start/stop events). Break-glass infrastructure access (cloud console / database / secret manager) is reserved for named production owners during severity-1 recovery and follows a two-person process. Support access is least-privilege and ticketed — not unrestricted production access for all engineers.

Buyers in active procurement can request the support-access / break-glass procedure summary under NDA by emailing Ollie@safegora.com.

Vulnerability disclosure

We welcome good-faith reports from security researchers. Send findings to Ollie@safegora.com. Our machine-readable contact is at /.well-known/security.txt (RFC 9116). We follow a 90-day coordinated disclosure window from initial triage. Full researcher guidelines live on /security.

AI governance

SafeGora's AI is governed by design, and the controls are product behavior, not policy prose. A person controls the record: AI output stays a draft until a person reviews it. Two exceptions: Defect Snap can place a temporary do-not-operate hold on equipment when a defect is severe, and scheduled AI runs can send their own summary notifications. Citations are verified: regulatory citations are checked against the jurisdiction's regulation text, and anything that cannot be verified is flagged for human review rather than presented as authoritative. Disclosure by default: AI surfaces identify themselves, AI-assisted drafts are labeled as pending review, and approved records carry a reviewed-and-approved attribution. The full control set, including fallback behavior when verification is unavailable, is documented on the AI governance page.

Certifications and attestations

SafeGora does not hold a third-party security attestation today. SOC 2 Type II is in progress (Type II target H1 2027). ISO 27001 evaluation is planned after SOC 2 Type II issuance. ISO/IEC 42001 (AI management systems) evaluation is on the roadmap alongside it, reflecting the AI-governance controls above. HIPAA / BAA is not in scope today. See the certifications roadmap on /security. Do not treat this Trust Center as proof of completed certification.

Engineering verification

Third-party attestations are one kind of trust; day-to-day engineering evidence is another. SafeGora maintains repository CI gates, module test batteries and workers' compensation first-report certification checks in source. Where a Trust Center statement asserts signed evidence, module coverage, or recurring production probes, that statement is limited to artifacts that can be identified by date, coverage definition and current source or run binding on request. Affirmative claims without those attachments are not certified by this page. Open items stay open; they are not marked green to satisfy procurement wording.

Procurement recipients may request the current engineering evidence pack via Ollie@safegora.com. Any pack provided is an engineering evidence artifact for the named modules and period, not a third-party attestation, and does not replace the certifications roadmap above.

Procurement packet

Enterprise buyers can request a deal-minimum trust packet (security overview, isolation summary, privacy / DPA stance, IR/DR posture, and held-claim fences) via Ollie@safegora.com. Signed legal exhibits and full questionnaire packs are handled case-by-case with Legal and Security — not all artifacts are self-serve public downloads yet.

What we do not claim here

• That a trust center is complete or that every trust artifact is public.
• That SafeGora is SOC 2 certified, or that a VPAT / WCAG AA program is complete.
• That all enterprise integrations (SSO, SCIM packages, and related buyer-live federation) are live.
• Multi-region customer data residency or customer-selectable region pinning beyond the current us-west1 posture.

Contact

Security and trust: Ollie@safegora.com. Privacy and data-subject requests: Ollie@safegora.com. Legal and contract: Ollie@safegora.com.