Compliance
Compliance
Where Missived stands on security and privacy standards, what we do ourselves, and what the companies we run on are certified for. We'd rather tell you exactly where we are than let a logo imply more.
Where we stand
Missived does not yet hold its own SOC 2 report or ISO 27001 certification. We're working towards an independent SOC 2 audit and will pursue it as soon as we can. Until then, our infrastructure providers' certifications cover the data centres, networks and platforms we run on. They don't certify Missived itself: how we build, run and secure the service is our responsibility, and it's described on our security page.
| Standard | Where Missived is today |
|---|---|
| SOC 2 | No report yet. We're preparing for an independent audit, starting with a Type I and then a Type II. We'll say so here when we have one. |
| ISO/IEC 27001 | Not certified. Many of its technical controls are in place; the management system it certifies isn't yet. |
| GDPR (EU / UK) | We don't offer Missived in the EU or UK yet, and our servers are in the US. Our privacy notice covers your rights, and you can export or delete your data yourself. Tell us if you'd like Missived in the EU or UK. |
| CCPA and US state privacy laws | We never sell or share personal information, never use it for advertising, and you can see, download and delete what we hold. |
| HIPAA | Not suitable for protected health information. Please don't use Missived for patient or other health data covered by HIPAA. See below. |
| PCI DSS | Payments are taken on Stripe's own hosted checkout. Missived never sees, sends or stores card numbers. |
What Missived does itself
These are ours, built into the service and tested. The security page explains each in detail.
- Encryption in transit and at rest. Every connection uses TLS. Messages (direct and group messages too) are sealed with each workspace's own key in every workspace, and files are encrypted before they're stored. Owners can rotate their workspace's key. It isn't end-to-end encryption yet: our servers hold the keys, so they can search, filter and notify. What's encrypted today lists every part.
- Two-step sign-in and confirmation for big changes. Authenticator apps, backup codes and a code for every new device; your password and current code again before exporting, deleting or handing over a workspace. On the Business plan, a workspace can also require its own single sign-on (OIDC or SAML).
- Audit logs. Owners and Admins can see who changed what, export it, and stream it to their own tools. Audit and security records are kept for a year.
- Backups. Database backups are encrypted as they're made, and the key to open them isn't kept on our servers.
- A written retention schedule. Security records and bug reports a year, expired sessions 30 days, server logs 30 days, and the rest as our privacy details say.
- Content-free logs. Our app's logs record what kind of request it was, whether it worked and how long it took — never message text, names, email addresses or your network address.
- Your data, your call. Download your data, delete your account, and an Owner can export or delete a whole workspace, with everyone told first.
- Reviewed changes. Every change is tested and reviewed before it can be merged, with automatic scanning for risky code, leaked secrets and vulnerable libraries.
- A data processing addendum. We've drafted one for workspaces that need it; it's with our lawyer and you can sign it once that review is done.
- An incident process. If something goes wrong with your data, we have a written process for containing it and telling the people affected without delay.
Still to come, and we'll say so here when they're done: virus scanning of every upload, confirming the disks of our own servers are encrypted underneath everything above, and an independent penetration test.
Our infrastructure providers
These are the companies that run the service, and what each says it is certified for on its own pages, read on 3 November 2026. Their certifications cover their own services and facilities, not Missived. The full list of every company that touches your data, and what each one sees, is on our privacy promise.
| Provider | What we use it for | What it says it's certified for |
|---|---|---|
| OVHcloud US | The servers we rent and run ourselves in Vint Hill, Virginia: the app, its database and our call servers | SOC 1 and SOC 2 Type 2 (security, availability, confidentiality) with dedicated servers at Vint Hill in scope, and a public SOC 3 report for 2025; ISO/IEC 27001, 27017, 27018 and 27701 for its US services and data centres; PCI DSS Level 1 for bare-metal servers; a HIPAA Type 1 attestation. On rented servers the operating system, software, network filtering and backups are ours to run, not OVHcloud's. Compliance, SOC reports, ISO, who does what |
| Cloudflare | DNS, this website and the app's files (Pages), encrypted file storage and backups (R2), small scripts at the edge (Workers), forwarding mail to [email protected] | SOC 2 Type II (security, confidentiality, availability) with DNS, Pages, R2 and Workers named in scope; ISO/IEC 27001, 27018 and 27701 for its global cloud platform; PCI DSS Level 1 service provider. Email Routing, which forwards our hello@ mail, isn't named on its SOC 2 or PCI lists. SOC 2, ISO, PCI DSS |
| Resend | Sending our email, and the mailboxes for mail you send us | SOC 2 Type II (period February 2025 to February 2026), and a data processing agreement with the EU standard contractual clauses. Resend says it doesn't hold ISO 27001 and can't sign HIPAA agreements. Security, SOC 2, GDPR |
| Stripe | Checkout, invoices and the billing page for paid plans | PCI DSS Level 1 service provider; SOC 1 and SOC 2 Type II reports every year and a public SOC 3; ISO/IEC 27001. Stripe's guide puts its hosted Checkout in the simplest merchant self-assessment (SAQ A), because card details are entered only on Stripe's pages. Security, PCI guide |
| DigiCert | Trusted timestamps on e-signature seals (coming soon) | Audited every year under the WebTrust programme for public certificate authorities. Its SOC 2 and ISO 27001 cover other DigiCert services, and the timestamps we'd use aren't EU "qualified" ones. WebTrust audits, timestamp service |
| Browser push services | Delivering notifications, only if you turn them on | Apple's ISO/IEC 27001 and 27018 certificates name its push service, which Safari uses. Google says Firebase Cloud Messaging, which Chrome's notifications travel through, has completed ISO 27001 and SOC 1, 2 and 3 audits. Microsoft's and Mozilla's published certifications don't name their browser push services. Apple, Google Firebase, Mozilla |
| Google (sign-in and call set-up) | "Continue with Google" if you choose it, and, for now, the public servers your browser asks for its network address when a call starts | Google Cloud and Workspace hold ISO/IEC 27001 and SOC 2 Type II, but their published scopes don't name ordinary Google sign-in or the public call servers. ISO, SOC 2 |
| Twilio (call set-up) | For now, the same public call servers as Google's | ISO/IEC 27001, 27017 and 27018, and SOC 2; Twilio says these don't apply to every product, and it doesn't say whether its public call servers are covered. Security |
| Anthropic | The assistant that sorts bug reports you choose to send it | For its commercial products, including the API we use: SOC 2 Type I and Type II, ISO 27001:2022 and ISO/IEC 42001:2023 (AI management). Its commercial terms don't let it train on what we send. Certifications, terms |
Most of these reports are shared under a confidentiality agreement, so we can't publish them. If your review needs one, we'll tell you how to ask the provider for it.
Health and other regulated data
Missived isn't built for data that a law requires special handling for:
- Health information (HIPAA). We don't sign Business Associate Agreements, and our servers can read message content. Don't use Missived for protected health information.
- Card data. Never post card numbers in chat; we take payments only through Stripe's own pages.
- Government and defence work (FedRAMP, CMMC, ITAR) isn't something we support.
If your organisation has rules like these, talk to us first and we'll tell you honestly whether Missived fits.
Security questionnaires and reviews
Send your security questionnaire, vendor-review form or data processing questions to [email protected] with "Security questionnaire" in the subject. A person reads every message, and we'll answer it plainly, including where the answer is "not yet". Found a security problem? See how to report it.