Security

Trust posture for a data substrate.

CCEN holds the operational data your business runs on. The way we treat it matters. Below is how the platform is built and how we hold ourselves to it.

SOC 2 Type II
Audited annually by Schellman.
Last audit
Feb 2026
Next audit
Feb 2027
Sub-processors
Public list
Encryption
AES-256 / TLS 1.3
Regions
US · EU · AU
Status page
status.ccen.co
Posture

What we have, in plain English.

SOC 2 Type II

Audited annually by Schellman against the AICPA Trust Services Criteria. Reports available under NDA via security@ccen.co.

Encryption in transit and at rest

TLS 1.3 in transit. AES-256 at rest. Customer-scoped KMS keys for sensitive surfaces (PII, payment metadata).

Single sign-on, SCIM

Clerk-backed SAML and OIDC SSO on every tier. SCIM provisioning on Scale and Platform. Just-in-time provisioning supported.

Immutable audit trail

Every mutation records actor, source app, scope, timestamp, IP, and result. Append-only. Exportable to your SIEM.

App isolation

iframe per app, per-subdomain origin, strict CSP, COOP and COEP. Apps share no JS context with the host or each other.

Data residency

US, EU, and AU regions on Scale and Platform. Customer DPAs and sub-processor lists on request.

Backup and recovery

Continuous Postgres replication. Point-in-time restore to 30 days. Quarterly disaster-recovery drills documented in the SOC 2 evidence pack.

Monitoring and alerting

On-call engineering rotation. Alert on anomalous auth, scope violations, and rate-limit anomalies. Customer notification within 72 hours of confirmed incident.

Data lifecycle

From ingest to deletion certificate.

Your data passes through seven stages on CCEN. Each stage has a clear owner, a clear audit hook, and a clear way out.

  1. 01
    Ingest

    Channel sync, EDI, manual upload. TLS 1.3 in transit. Schema validated at the boundary.

  2. 02
    Persist

    AES-256 at rest. PII encrypted with customer-scoped KMS keys. Postgres + ClickHouse + Typesense, all encrypted.

  3. 03
    Access

    RLS-backed scopes for every entity. Per-app, per-user enforcement. Every read recorded.

  4. 04
    Mutate

    Audit-trailed by default. Actor, source app, scope, timestamp recorded for every write.

  5. 05
    Replicate

    Cross-region replication with at-least-once delivery. Point-in-time recovery to 30 days.

  6. 06
    Export

    Parquet snapshots to your S3 bucket. DuckDB-native query layer. EDI, SFTP, API, webhooks. Full filesystem download on request.

  7. 07
    Retain or delete

    Configurable retention windows per entity. Hard-delete flow that propagates through replication and exports. Documented destruction certificate.

App isolation

iframe-grade isolation, non-negotiable.

Third-party apps run inside iframes served from per-app subdomains. They share no JS context with the host or with each other. We rejected Shadow DOM (style-only encapsulation), Web Workers (no DOM), and WASM UI sandboxes (still renders through host JS).

  • Per-app subdomain (origin-based isolation, scoped cookies, per-app CSP)
  • Sandbox attribute with conservative defaults (allow-scripts, allow-same-origin, allow-forms)
  • Strict per-app Content Security Policy
  • Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy
  • Per-install tokens, scoped to (app, merchant, install)
Boundaryhost ↔ iframe
Host (ccen.co)
Renders L0 surfaces. Owns auth, routing, command palette.
postMessage · typed
App (<app-id>.apps.ccen.co)
Sandboxed iframe. Scoped tokens. Strict CSP.
Even first-party CCEN apps run through this boundary. There is no privileged code path.
Compliance

Frameworks we hold ourselves to.

SOC 2 Type II
Active

Audited annually by Schellman.

GDPR (EU)
Aligned

Standard contractual clauses, EU data residency on Scale.

CCPA
Aligned

Consumer rights flows wired into the customer record.

PCI DSS
Out of scope

We don't store cardholder data. Stripe and Adyen handle it.

HIPAA
On request

Available on Platform tier with BAAs.

ISO 27001
In progress

Targeted certification Q4 2026.

Vulnerability disclosure

Found something? Tell us.

We run a coordinated disclosure program. Report any vulnerability to security@ccen.co with reproduction details. We acknowledge within one business day, fix critical issues within seven days, and credit reporters who want public credit.

Bounty range: $250 to $25,000 depending on severity. We follow CVSS 3.1.

Disclosure timeline
By severity
CriticalPatch within 7 days
HighPatch within 30 days
MediumPatch within 60 days
LowNext release window

Have a security questionnaire? We’ve seen it.

Send your standard SIG, CAIQ, or custom questionnaire. We’ll fill it out and return it within one business day on Scale and Platform tiers.