Skip to main content

Security & Privacy

This page is the detailed, engineering-accurate companion to the Trust Centre on the marketing site. If you need something you can hand to a security or procurement reviewer, start here; for the signed legal documents themselves, see Live legal pages below.

Access control & audit​

  • RBAC on every operation. Every GraphQL Query and Mutation field carries an @rbac directive, enforced at the API gateway edge — the backend service never re-implements auth and never trusts an unauthenticated caller.
  • Multi-tenant isolation. Every workspace's contacts, campaigns, and assets are isolated from every other workspace by default; there is no ambient "read everything" role.
  • End-to-end audit log. Every campaign, send, and approval is recorded with the acting actor, target, and result, and is searchable and exportable by workspace admins.
  • Identity is validated once at the gateway edge (OIDC SSO / OAuth2), so a single sign-in carries the same permissions across every Burdenoff product.

Encryption​

  • In transit: TLS on every connection, including gateway-to-service traffic.
  • At rest: Standard encryption at rest on all backing Postgres and object storage.
  • Field-level: The most sensitive stored fields — third-party OAuth accessToken/refreshToken values for connected social accounts — use AES-256-GCM field-level encryption on top of at-rest disk encryption, with per-environment keys held in Azure Key Vault (never in source or .env).
  • Export path parity: Encrypted fields are excluded from the bulk data-export pipeline as well as the GraphQL API — there is no back door that returns them in plaintext.

Data residency & international transfers​

Customer data is stored in India by default — backend services run primarily on Microsoft Azure Central India, with object storage and transactional email on AWS ap-south-1 (Mumbai).

For transfers out of the EEA, UK, or Switzerland, HeadshotMarketing's Data Processing Addendum incorporates:

  • the European Commission's Standard Contractual Clauses (SCCs), Module 2 (Controller-to-Processor);
  • the UK International Data Transfer Addendum to the SCCs;
  • the Swiss FDPIC-approved variant of the SCCs.

Customers who require contract-level data localisation for contact records can configure that on their Order Form. Full detail: Privacy Policy §7.

Data Processing Addendum & subprocessors​

Subject rights (DSAR)​

Under GDPR, UK GDPR, India's DPDP Act, and applicable US state privacy law, you can access, correct, erase, port, restrict, or object to processing of your personal data. Email [email protected] — the default turnaround follows the strictest applicable statutory maximum (30 days GDPR/DPDP, 45 days CPRA).

Compliance status — read this before assuming anything​

HeadshotMarketing is pre-launch. Here is exactly what is true today, not aspirational:

ItemStatus
GDPR/CCPA posture (DPA, data residency, subject-rights workflow)Published — see above
SOC 2 Type II attestationNot yet earned. No accredited external auditor has been engaged. This is a real gap for regulated-enterprise buyers, not a certification HeadshotMarketing currently holds. The Trust Centre will link the report once the audit is complete.
HIPAA / PCI-DSS / other accredited attestationsNot applicable to this product today; not claimed.

Reporting a vulnerability​

If you discover a security issue, email [email protected] before disclosing publicly and give us reasonable time to remediate. Do not access, modify, or exfiltrate data that isn't yours. A formal bug-bounty program is planned around launch.

Last updated on