Trust Center

Security, compliance, and data protection — everything your security team needs

Compliance Status

Live status of compliance certifications and attestations.

SOC 2 Type I

Achieved

Completed Q4 2025

SOC 2 Type II

In Progress

Observation period — expected Q3 2026

ISO 27001

In Progress

Gap analysis complete — certification Q4 2026

GDPR

Achieved

DPA available — EU data processing compliant

HIPAA

Planned

BAA available for healthcare customers — Q1 2027

PCI-DSS

Achieved

Level 1 service provider — no cardholder data stored

Data Flow Architecture

See exactly where your data flows for each deployment model.

SaaS — Your Data Never Leaves Your Cloud

Cupel orchestrates; your cloud computes. Only schema metadata and pipeline status flow to the control plane.

Your Cloud

Customer-managed infrastructure

Data Warehouse

Snowflake, BigQuery, Redshift — your data stays here

Object Storage

S3, GCS, ADLS — raw files never leave your account

Compute

Snowpark, Glue, Dataflow — heavy processing in your cloud

All customer data stays here

Schema metadata, pipeline status, quality scores only

Cupel Control Plane

Orchestration and metadata only

Pipeline Orchestration

Temporal workflows — coordinates execution steps

Schema Metadata

Table names, column types — never raw data values

Quality Scores

Pass/fail results, row counts, SLA metrics

Audit Trail

Who did what, when — immutable compliance log

Zero customer data at rest

At Rest

AES-256-GCM

Per-tenant data keys via AWS KMS

In Transit

TLS 1.3 (min 1.2)

mTLS for pod-to-pod communication

Key Management

BYOK Supported

AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault

Shared Responsibility Matrix

Clear delineation of security and operational responsibilities between Cupel and your organization.

CupelCupel manages

CustomerYou manage

SharedJoint responsibility

Responsibility	Description	SaaS	Agent-in-VPC	Hosted
Data Encryption at Rest	AES-256-GCM encryption of stored data	Customer	Customer	Cupel
Data Encryption in Transit	TLS 1.3 for all data movement	Shared	Shared	Cupel
Platform Patching	Security updates to Cupel software	Cupel	Cupel	Cupel
Infrastructure Scaling	Compute and storage scaling	Customer	Customer	Cupel
Backup & Disaster Recovery	Data backup and recovery procedures	Customer	Customer	Cupel
Access Control (RBAC)	User roles and permissions management	Shared	Customer	Shared
Incident Response	Detection, triage, and resolution	Cupel	Shared	Cupel
Compliance Certifications	SOC 2, ISO 27001, HIPAA attestations	Cupel	Shared	Cupel
Network Security	Firewalls, VPC isolation, IP allowlisting	Customer	Customer	Cupel
Key Management	Encryption key lifecycle and rotation	Customer	Customer	Shared
Audit Logging	Immutable trail of all platform actions	Cupel	Cupel	Cupel
Data Classification	PII detection and sensitivity tagging	Cupel	Cupel	Cupel
Data Residency	Ensuring data stays in required region	Customer	Customer	Shared
Identity Provider (SSO)	SAML/OIDC federation and MFA	Shared	Customer	Shared

Compliance Artifacts

Request access to compliance documentation. NDA may be required for audit reports.

SOC 2 Type I Report

Bridge letter and full audit report (NDA required)

Data Processing Agreement

GDPR Article 28 compliant DPA

Security Questionnaire (SIG Lite)

Pre-filled SIG Lite v2024 responses

CAIQ (Cloud Security Alliance)

Consensus Assessment Initiative Questionnaire

Penetration Test Summary

Most recent CREST-certified pen test executive summary

Architecture Whitepaper

Technical architecture and security controls overview

Subprocessor List

Current list of subprocessors (Auth0, AWS, Stripe, Temporal)

Incident Response Plan

Detection, triage, escalation, and notification procedures

Subprocessors

Third-party services that process data on behalf of Cupel. Required by GDPR Article 28.

ServicePurposeData ProcessedLocation

Amazon Web ServicesCloud infrastructure (EKS, RDS, S3)Pipeline metadata, audit logsUS, EU (customer choice)

Auth0 (Okta)Authentication and SSOUser email, roles, session tokensUS, EU

StripeBilling and payment processingOrganization name, billing emailUS

Temporal TechnologiesWorkflow orchestrationPipeline execution state (no customer data)US

SentryError monitoring and performanceStack traces, performance metrics (no PII)US

Incident Response SLA

15 min

Time to Detect

Automated monitoring + alerting

1 hour

Time to Notify

Customer notification for P1/P2 incidents

4 hours

Time to Resolve (P1)

Critical incidents — 24/7 on-call