99.99%
Uptime SLA, Scale and up
See how the message archive is protected
A message archive holds contracts, agreed dates, prices and client conversations. Each workspace writes into its own storage partition, encrypted at rest under keys that belong to that workspace.
AES-256
Encryption at rest
EU by default
Data residency
In progress
SOC 2 Type II
European cloud infrastructure
The default cloud deployment uses EU regions in Frankfurt and Amsterdam, and Enterprise residency follows its order form. Servers are built from code, and opening a production shell needs a documented break-glass approval that pages a second engineer.
Hardened server images
Base images take automated security patches weekly. Containers run rootless with the smallest privilege set that works.
Isolated database networks
Databases sit in private subnets with no public route. Only internal application workers can reach them.
Automated backup runs
Snapshots write to a second European region every 60 minutes.
Disaster recovery targets
The recovery point objective matches the 60 minute snapshot interval.
Data encryption and key control
Network traffic runs over TLS 1.3 and disk storage uses AES-256-GCM. Per-tenant data keys rotate on their own under a KMS root key. An Enterprise account supplies its own root key and can revoke our access in one action.
In transit
An incoming connection needs TLS 1.3 with a strict cipher suite. Older protocol versions are switched off.
At rest
Message payloads, metadata, search segments and attached media are stored with AES-256-GCM.
Key hierarchy and rotation
Each tenant holds its own data encryption keys. Root keys rotate every 90 days inside a dedicated KMS.
Your own root key
On Enterprise you hold the root key in your own AWS KMS or HashiCorp Vault, and revoking it locks us out.
Tenant data isolation
A customer runs inside its own database schema, with the tenant filter enforced where queries are built rather than where they are written. Search indexes stay separate. An Enterprise customer can run the deployment inside its own VPC.
Search runs against partitioned stores, so each workspace has its own indexing boundary.
Separate schema per tenant
Each workspace owns its own logical database schema. There is no shared messages table.
Tenant id at the query layer
The data access layer refuses to compile a query that does not carry a tenant predicate.
Separate search index
Index shards are partitioned by workspace id, and a query runs only against the shards for the workspace that authenticated it.
Single-tenant drafting adapter
PersonaLearn fits an adapter inside the workspace whose messages built it, and that adapter is used only for that workspace.
SELECT … FROM messages — rejected: missing tenant predicate
Identity and access
Decide how people sign in and which conversations they can open. CommunicationOS plugs into your identity provider and requires a second factor on every account in the workspace.
Corporate SAML SSO
Route sign-on through Okta, Microsoft Entra ID or Google Workspace over standard SAML 2.0.
SCIM provisioning
Team rosters sync automatically. Removing someone in your directory ends their session.
Two-factor authentication
A WebAuthn key or an authenticator app on every account, with no opt out. Team and above add workspace-wide policy reporting.
Per-thread permissions
Set access rules by network or by thread, so one conversation can stay closed while the rest of the project stays open.
Append-only audit log
The log records each search, message read, export, generated draft and permission change, with the actor, the IP address, the timestamp and the object touched. A row cannot be edited or removed, including by us.
Each read and export is written to the log on every plan. Customer access to the log starts on the Team plan, where you can read it in the app or stream it into your own SIEM over the webhook or the SDK. We keep our copy for seven years.
Audit event schemaaudit_stream.jsonl
2026-08-22T08:41:02Z thread.read actor=l.martin@… ip=81.82.x.x obj=thr_9fJ2
2026-08-22T08:41:19Z search.run actor=l.martin@… ip=81.82.x.x q="northstar launch date"
2026-08-22T08:44:51Z export.create actor=admin@… ip=81.82.x.x size=2.4GB
2026-08-22T09:02:07Z permission.grant actor=admin@… ip=81.82.x.x obj=chan_wa_07
2026-08-22T09:11:33Z draft.generate actor=s.costa@… ip=81.82.x.x model=personalearn
The audit that is underway
An outside firm is running our SOC 2 Type II observation window now. Nothing is published until the report lands, and ISO 27001 comes after it. The control documentation that exists today goes out under NDA.
SOC 2 Type II
An audit in progress across security, availability and confidentiality.
ISO 27001
Planned. An information security management system built for certification later.
GDPR
EU processing, a signed DPA and a named data protection officer.
Request the compliance pack
One archive with the security policy set, the penetration test summary, the standard DPA, the subprocessor registry, our completed SIG questionnaire and a letter stating where the SOC 2 audit stands. The report joins the pack when the audit closes.
The vendors we use
This registry is current as of August 2026 and it is dated on every change. Account owners get an email 30 days before a vendor is added, which gives your security team time to review it or object.
Vendor
Purpose
Location
Data reached
Discord Netherlands B.V.
Internal alerting for website enquiry and access-request forms
Work email, company and the message typed into a website form
Amazon Web Services EMEA
Primary compute, object storage and KMS
Message content, media, encryption keys
Google Cloud EMEA
Secondary region for Amsterdam residency
Message content, media
Cloudflare Germany GmbH
Edge TLS termination, DDoS filtering, WAF
Request metadata, IP addresses
Mistral AI SAS
Summaries, classification and translation
Message text sent for the requested task
Twilio Ireland Limited
SMS and voice channel carriage
Phone numbers, SMS bodies, call metadata
Meta Platforms Ireland Limited
WhatsApp Business API, when you pick that route
WhatsApp message content and phone numbers
Mailjet SAS
Transactional and notification email
Recipient email address, notification body
Stripe Payments Europe Limited
Card processing and invoicing
Billing name, billing email, card token. No message content
Anthropic PBC
Optional drafting model for PersonaLearn
Draft prompt text
Voice transcription, media understanding and search are not listed as subprocessors because those services run on CommunicationOS-operated hardware in Frankfurt.
Where the data lives
Primary stores sit in Frankfurt or Amsterdam, and you choose which at signup. Default cloud storage and processing stay in the EU, and Enterprise residency follows its order form. An Enterprise customer deploys into its own VPC in the region it picks.
When it goes away
You set the purge rule, from 30 days to no time limit at all. A deletion runs against the live database within 7 days and works through the backup copies within 14 days. A legal hold on a named thread overrides the purge rule until you lift it.
Report a vulnerability
Write to security@commsos.com and ask for our PGP key in the first message. We send it back before you share any detail, and we pay a bounty for a valid report. Good faith research gets safe harbour.
Send the review to your CISO
Read the compliance pack under NDA, sign the DPA, then plan the rollout with us.