Encryption
Data in transit is protected with TLS 1.2+. Data at rest in our managed database and object storage is encrypted with AES-256.
Security
How we protect your contacts and CRM data
mTap handles contact, event, and CRM-integration data. Here is the honest posture — what is in place today, and what is in progress. We will never claim a certification we do not hold.
SOC 2 status: Type II is targeted, not yet certified. Once we hold an attested Type II report, we will publish the date and the auditor. Until then, we are happy to share our current controls under NDA.
CRM integrations
Every CRM integration is OAuth-based. mTap never stores user passwords or long-lived credentials, and tokens are scoped to the minimum permissions required.
Enrichment data
Enrichment runs through vetted providers under Data Processing Agreements. We pass the minimum identifiers required and never sell contact data.
Access controls
Production access is restricted to a small set of engineers, MFA-required, audit-logged, and reviewed quarterly.
Backups & availability
Automated daily backups with point-in-time recovery. Status and uptime are reported to customers on request.
Privacy alignment
Our practices align with GDPR and CCPA. Users can submit access, correction, and deletion requests at any time.
Security questions, answered
- Is mTap SOC 2 certified?
- SOC 2 Type II is targeted, not yet certified. We will only publish a SOC 2 badge once a Type II report from an accredited auditor is in hand. We are happy to discuss our current controls under NDA.
- Where is data stored?
- Customer data is stored in managed databases hosted in the United States. EU customer data residency is available on enterprise plans on request.
- How do CRM integrations authenticate?
- Every CRM integration uses OAuth 2.0. We never ask for or store user passwords, and access tokens are scoped to the minimum required permissions.
- Can we sign a DPA?
- Yes. Email privacy@mtap.io and we will send our standard Data Processing Agreement.
- How do users delete their data?
- Users can submit an access, correction, or deletion request from /privacy/requests. We respond within the statutory timeframes (30 days under GDPR; 45 days under CCPA).
See related: Integrations, Enrichment, Privacy Policy.
Last updated: