Frameworks
What’s covered
Data at rest
- AWS-managed KMS encryption on all DynamoDB tables, S3 buckets, and Secrets Manager secrets.
- Customer data is logically isolated per organization.
- Backups are encrypted with the same KMS keys; backup retention aligns with the source data’s retention.
Data in transit
- TLS 1.2+ for every external connection. TLS 1.3 preferred.
- Database connectors require certificate validation; self-signed certs are rejected.
- Internal service-to-service traffic is also TLS-encrypted within AWS VPCs.
Identity and access
- All authentication routed through WorkOS, which is itself SOC 2 Type II compliant.
- MFA enforceable at the org level (WorkOS) and at sensitive-operation level (Summand).
- Sessions are managed by WorkOS AuthKit and refresh on the standard short-cookie/long-refresh pattern. Enterprise customers can adjust session lifetime per-org through the WorkOS Admin Portal.
- Cookie attributes:
HttpOnly,Secure,SameSite=Laxfor CSRF protection.
Audit and monitoring
- All identity events retained for 6+ years (WorkOS).
- All application events retained 1-6 years depending on tier.
- Log streaming to customer-controlled SIEMs (Datadog, Splunk, S3, HTTPS).
- CloudWatch alarms on Lambda errors, DLQ depth, and authorization failures.
Operational security
- Annual third-party penetration test; report shared under NDA on request.
- Quarterly internal vulnerability scans.
- Dependencies tracked via Dependabot; security-relevant updates merged within 7 days.
- Production access via federated identity (no shared credentials); all production sessions logged.
Personnel
- Background checks for all employees with production access.
- Annual security awareness training.
- Access provisioning and deprovisioning automated through your-IdP-of-record (we use the same WorkOS we sell).
HIPAA-specific notes
For Protected Health Information (PHI):- A Business Associate Agreement (BAA) is required and provided to all Enterprise customers handling PHI.
- PHI must be processed within Summand’s HIPAA-eligible services. By default, all Summand infrastructure is HIPAA-eligible.
- Audit log retention is set to 6 years to meet HIPAA’s audit standard.
- Optional: dedicated infrastructure for organizations with the strictest requirements. Contact sales.
GDPR / data protection
- Summand processes personal data only as instructed by the customer (data controller). We’re a processor under GDPR.
- A Data Processing Addendum (DPA) is included in every Enterprise contract.
- Subprocessors are listed on our trust page. Material changes are notified 30 days in advance.
- Customer data can be deleted on request; a confirmation of deletion is provided within 30 days.
Data residency
- All Summand infrastructure runs in AWS
us-east-1(Northern Virginia). - For customers with strict residency requirements outside the US, contact sales@summand.com — alternative regions can be discussed under contract.
Subprocessors
A complete, current list lives at summand.com/subprocessors. The headline ones:- AWS — primary infrastructure
- WorkOS — identity, SSO, Directory Sync, audit logs
- Stripe — billing
- Anthropic — backs the Summand AI assistant
- Vercel — frontend hosting
Customer responsibilities
A few controls are yours to configure:- MFA enforcement — required vs. optional, set per org.
- SSO setup — verify domains, configure connections.
- Sharing decisions — who you grant access to, and at what visibility.
- Audit log review — Summand exposes the data; routine review is your security team’s responsibility.
- Off-boarding — pair SSO with Directory Sync so user removal is automatic.