Last updated: 2026-04-30
Trust Center.
Security, compliance, and controls posture for Permission Protocol.
Posture summary
Permission Protocol is built for enforcement, not just observation. Below is our current security and compliance posture, our roadmap, and how to request the controls your team needs.
Compliance roadmap
SOC 2 Type I
Q3 2026
Audit prep underway
SOC 2 Type II
After Type I
Follows initial controls validation
GDPR
In progress
DPA template available; SCC clauses on request
HIPAA / FedRAMP
On request
Evaluated case-by-case
Penetration test
On roadmap
Annual third-party; report shared under NDA
Auth & access
- 🟢 GitHub OAuth
- 🟡 SAML SSO — Enterprise tier, target Q3 2026
- 🟡 SCIM provisioning — Enterprise tier, target Q3 2026
- 🟢 Per-repo and per-environment scoping
- 🟢 Signer key rotation
- 🟡 Hardware key (WebAuthn) signing — On roadmap
Data handling
Data we store: GitHub usernames, org IDs, repo metadata, PR metadata, commit SHAs, approval decisions, signer identity, receipts, and workflow events.
Data we do NOT store: Source code, secrets, customer PII outside GitHub identity tuples, or payload bodies.
Retention: 90 days hot storage, with signed receipts retained for audit history.
Encryption: TLS 1.3 in transit, AES-256 at rest.
Region: US primary; EU data-region handling available for Enterprise tier on request.
Reliability
Uptime target: 99.9% for Production Pilot tier and above.
Status page: Live monitoring at status.permissionprotocol.com. Uptime, incidents, and component health are public.
Failure mode: Fails CLOSED by default (see permission-protocol/gate@v1).
Receipt verification: Receipts are designed for independent verification. CLI-based local verification is on the roadmap.
Subprocessors
Vercel
Site hosting and delivery
Render
Application and database hosting
PostHog
Product analytics and usage telemetry
Postmark
Transactional email delivery
Sentry
Error monitoring and diagnostics
KickoffLabs
Waitlist/contact campaign processing
Discord
Operational notifications
Contact
Need a DPA, security questionnaire, vendor risk packet, or pen-test letter? Email [email protected] and we respond within 2 business days.