Security
Enterprise-grade security and compliance. By design.
SOC 2 Type II, SSO and directory sync, audit log streaming, and an architecture that does not store your data.
Security and compliance without compromise.
Built for organisations where security reviews are thorough and compliance is mandatory.
SOC 2® Type II
The gold standard for compliance. Unlike a point-in-time audit, Type II verifies our controls operate effectively over an extended period, independently examined for Security, Availability and Confidentiality.
SSO. One click, your identity provider.
Secure access through your identity provider. SAML 2.0 and OpenID Connect supported. Your team signs in with credentials they already have.
Microsoft Entra ID
Okta
Google Workspace
Directory sync. Users managed automatically.
Sync users directly from your corporate directory (Microsoft Entra ID, Okta, Google Workspace). Access is provisioned and deprovisioned automatically as your team changes.
DatadogAudit logs. Stream to your SIEM.
Stream user activity and security audit logs to your existing SIEM provider. Compatible with services like Datadog and Splunk for centralised monitoring and compliance.
ZscalerEndpoint protection. Restrict access to approved IPs.
Restrict login attempts to your approved IP ranges only. If you use a service like Zscaler, access is limited to your secure network, preventing unauthorised access from outside.
HSM encryption. Hardware-backed, always encrypted.
By design we fetch your data on the fly rather than storing it. Anything temporarily cached is encrypted at rest using a Hardware Security Module (HSM).
BYOK. Bring your own key.
For customers in regulated industries, bring your own key to encrypt your data at rest with a key you control.
Read-only by design. Your data stays in your warehouse.
KPI Tree connects to your sources with scoped, read-only credentials and runs one scheduled query per metric. It is an architecture that does not store your data, so a security review starts from a small, legible surface.
- Scoped, read-only service credentials
- TLS verified on every connection
- Secrets encrypted, never leaving the encrypted store
Warehouse connection
ConnectedRead-only access · credentials never leave the encrypted store
Something your security team needs? Bring your questionnaire.
We work with procurement and security reviews directly.