Security & Privacy
This page is the detailed, engineering-accurate companion to the Trust Centre on the marketing site. If you need something you can hand to a security or procurement reviewer, start here; for the signed legal documents themselves, see Live legal pages below.
Access control & audit
- RBAC on every operation. Every GraphQL Query and Mutation field carries an
@rbacdirective, enforced at the API gateway edge — the backend service never re-implements auth and never trusts an unauthenticated caller. - Multi-tenant isolation. Every workspace's contacts, campaigns, and assets are isolated from every other workspace by default; there is no ambient "read everything" role.
- End-to-end audit log. Every campaign, send, and approval is recorded with the acting actor, target, and result, and is searchable and exportable by workspace admins.
- Identity is validated once at the gateway edge (OIDC SSO / OAuth2), so a single sign-in carries the same permissions across every Burdenoff product.
Encryption
- In transit: TLS on every connection, including gateway-to-service traffic.
- At rest: Standard encryption at rest on all backing Postgres and object storage.
- Field-level: The most sensitive stored fields — third-party OAuth
accessToken/refreshTokenvalues for connected social accounts — use AES-256-GCM field-level encryption on top of at-rest disk encryption, with per-environment keys held in the platform secret store (never in source or.env). - Export path parity: Encrypted fields are excluded from the bulk data-export pipeline as well as the GraphQL API — there is no back door that returns them in plaintext.
Data residency & international transfers
Customer data is stored in India by default — backend services, object storage, and transactional email all run in the Mumbai, India region.
For transfers out of the EEA, UK, or Switzerland, HeadshotMarketing's Data Processing Addendum incorporates:
- the European Commission's Standard Contractual Clauses (SCCs), Module 2 (Controller-to-Processor);
- the UK International Data Transfer Addendum to the SCCs;
- the Swiss FDPIC-approved variant of the SCCs.
Customers who require contract-level data localisation for contact records can configure that on their Order Form. Full detail: Privacy Policy §7.
Data Processing Addendum & subprocessors
- DPA: available at burdenoff.com/contracts/headshotmarketing/HM-LEGAL-003, with annexes covering processing details, technical/organisational measures, and the current subprocessor list.
- Subprocessor list: kept current at headshotmarketing.com/subprocessors.
Subject rights (DSAR)
Under GDPR, UK GDPR, India's DPDP Act, and applicable US state privacy law, you can access, correct, erase, port, restrict, or object to processing of your personal data. Email [email protected] — the default turnaround follows the strictest applicable statutory maximum (30 days GDPR/DPDP, 45 days CPRA).
Compliance status — read this before assuming anything
HeadshotMarketing is generally available. Here is exactly what is true today, not aspirational:
| Item | Status |
|---|---|
| GDPR/CCPA posture (DPA, data residency, subject-rights workflow) | Published — see above |
| SOC 2 Type II attestation | Not yet earned. No accredited external auditor has been engaged. This is a real gap for regulated-enterprise buyers, not a certification HeadshotMarketing currently holds. The Trust Centre will link the report once the audit is complete. |
| HIPAA / PCI-DSS / other accredited attestations | Not applicable to this product today; not claimed. |
Reporting a vulnerability
If you discover a security issue, email [email protected] before disclosing publicly and give us reasonable time to remediate. Do not access, modify, or exfiltrate data that isn't yours. A formal bug-bounty program is planned around launch.