How we protect your data
Our work needs access to your CRM. Both our companies are certified to ISO/IEC 27001:2022, a CPA firm has examined Sellestial, Inc. for a SOC 2 Type 1 report, and this page shows where your data is, who can reach it and which documents you can get.
- Registration
- IC-IS-2605030
- Issued
- May 1, 2026
- Valid through
- April 30, 2029
- Registration
- IC-IS-2605031
- Issued
- May 1, 2026
- Valid through
- April 30, 2029
- Auditor
- Assurion Services LLC, a CPA firm
- As of
- October 1, 2026
- Criteria
- Security, Availability, Confidentiality
- Type 2
- In progress
ISO/IEC 27001:2022, certified by InterCert
SOC 2 Type 1, examined by Assurion Services LLC
EU-hostedIn Frankfurt, on DigitalOcean
24 hoursto tell you about an incident (the DPA says 72)
30 daysof point-in-time recovery, restore tested once a year
SSO and 2FAon every staff account; access removed within 24 hours
Scope, as InterCert states it: “The Information Security Management System applies to our AI-powered cloud platform for CRM data integrity and management, with the support functions of IT, Human Resources, Administration and Legal.” SOC 2: Type 1 report of Sellestial, Inc. as of October 1, 2026, under NDA in our Trust Vault; our Type 2 report is in progress.
Where is our data?
- Hosting
- In the EU, on DigitalOcean in Frankfurt, on managed Kubernetes. The system has one public entry point, and its databases are never open to the internet.
- Backups
- Encrypted, with providers separate from production: AWS in Stockholm and Hetzner in Falkenstein. Daily volume snapshots allow faster restores.
- Transfers
- AI and data providers process data outside the EEA, mostly in the United States, under the safeguards named in our subprocessor list.
- Subprocessors
- The list of companies that process data for us is available under NDA in our Trust Vault. Our DPA gives you 15 business days’ notice before we add one.
- AI providers
- No client data is used to train their models.
- Your rights
- You can export your data at any time in a standard format, and we delete it on request. We fulfill requests within 30 days.
Who can reach it?
- Our staff
- Google Workspace single sign-on with two-step verification. Only the production group can reach production systems. We review access regularly and remove it within 24 hours when a person leaves.
- Your users
- Google or Microsoft single sign-on, or a one-time email code.
- People
- Identity and reference checks before access, security awareness training every year, and confidentiality and data protection duties in every employment contract.
What happens in an incident?
- Monitoring
- Automated error, performance and infrastructure monitoring with alerts; audit logs of user and administrative events; operational logs kept for 90 days.
- Our targets
- Detection within 5 minutes, containment within 1 hour, first triage within 4 hours, and notice to you within 24 hours. The DPA commits us to 72 hours.
- Recovery
- Continuous log archiving allows point-in-time recovery within a 30-day window, which usually limits data loss to minutes. We test a full restore once a year.
How do you build and test?
- Encryption
- TLS in transit (TLS 1.0 and 1.1 are refused, HSTS is enforced) and AES-256 at rest. Secrets are kept in HashiCorp Vault, and database credentials rotate every 30 days.
- Changes
- Every production change is versioned in Git and deployed through CI/CD under our Change Management Policy. Lint and automated tests run on every merge request.
- Secure coding
- Our practice follows the OWASP Secure Coding Guidelines.
- Testing
- A third-party vulnerability assessment and penetration test of the platform. We triage and fix vulnerabilities by severity under our Patch and Vulnerability Management Policy.
Which documents can we get?
- ISO/IEC 27001:2022 certificates
- Both companies, valid through April 30, 2029 Inc. (PDF) for Sellestial, Inc.d.o.o. (PDF) for Sellestial d.o.o.
Questions: security@sellestial.com. We answer within 24 hours, and at any time for an emergency.