SOC 2
Sensiba completed our SOC 2 Type I audit in August 2026. The report covers our bring-your-own-cloud (BYOC) and on-premises deployments, and the controls we use to run the company day to day. Our SOC 2 Type II audit is now in its observation period.
Please email us at security@ersc.io if you would like to receive a copy.
Subprocessors
You give us information when you email or call us, submit our contact form, subscribe to our newsletter, report a bug, or request a feature. If we host ERSC’s software for you, we also store your code.
| Vendor | Purpose | Data | Where data is processed |
|---|---|---|---|
| Cloudflare | Website hosting, DNS, and delivery of contact form submissions | Contact form submissions, website visitors’ IP addresses, and request logs | Worldwide, across Cloudflare’s network |
| Attio | Customer relationship management | Contact details, correspondence, call recordings, and call transcripts | European Union |
| Google Workspace | Email, calendar, and documents | Correspondence, meeting invitations, and documents you share with us | Worldwide, in Google’s data centers |
| Google Cloud | Compute and storage | Your code and user accounts, if we host ERSC’s software for you | United States |
| Buttondown | Blog and newsletter | Subscribers’ email addresses, mailing-list preferences, and delivery records | United States |
| Linear | Issue tracking | Bug reports and feature requests | United States |
| Slack | Internal messaging | Bug reports and feature requests that Linear posts to Slack | United States |
| Honeycomb | Observability | If we host ERSC’s software for you: telemetry, including user and repository identifiers, file paths, branch names, and IP addresses | United States |
| Anthropic | AI-assisted development | Bug reports and feature requests that Claude reads from Linear; if we host ERSC’s software for you, telemetry that Claude reads from Honeycomb | Stored in the United States; processed in the United States, Europe, Asia, or Australia |
If you’d rather none of these vendors see your code, contact us about running ERSC’s software in your own cloud account (BYOC) or on your own servers (on-premises). In those deployments, we receive no data unless you send it to us.
Operational vendors
We also use the vendors below to run ERSC. These vendors do not receive your data.
| Vendor | Purpose | Based in |
|---|---|---|
| 1Password | Password and secret management | Toronto, Canada |
| Antithesis | Software testing | Vienna, Virginia, United States |
| Buildkite | Continuous integration | Melbourne, Australia |
| Drata | Security compliance | San Francisco, United States |
| Figma | Design | San Francisco, United States |
| Gusto | Payroll and benefits | San Francisco, United States |
| Mercury | Banking | San Francisco, United States |
| Tailscale | Private networking | Toronto, Canada |
Contact
Send security questions and vulnerability reports to security@ersc.io.