Security
Last updated: October 28, 2026
Your data stays protected, and data about your customers stays in the region you choose.
Summerbase is built on Google Cloud with customer data hosted in either the EU or the US. This page describes how we protect it and where we are on the path to SOC 2 Type II.
Email our security team at security@summerbase.com.
Compliance
We are open about what we have and what we are working toward.
SOC 2 Type II — In progress
We are not yet SOC 2 certified. We have adopted a full set of security policies aligned with the SOC 2 Trust Services Criteria for Security, Availability and Confidentiality, and plan to begin our audit observation period in 2027.
GDPR
Summerbase ApS is a Danish company and operates under GDPR, supervised by the Danish Data Protection Agency (Datatilsynet). We act as data processor for customer data and offer a Data Processing Addendum to every customer.
Infrastructure: Google Cloud
Our production environment runs on Google Cloud, whose data centers are covered by Google’s own SOC 2 Type II and ISO/IEC 27001 certifications. These cover Google’s infrastructure, not Summerbase itself.
Data hosting and residency
You choose where your workspace is hosted when you sign up. Data about your customers, which is what your integrations send us, is stored and backed up only in that region.
| Hosting | Primary region | Backups of data about your customers |
|---|---|---|
| EU | Netherlands | Stay within the EU |
| US | Iowa | Stay within the US |
Account data, meaning users, their names and email addresses, and organizations, is stored in the EU and copied to every region, so that one sign-in works everywhere. Shared views you publish are served from Cloudflare’s global network.
See our sub-processor list for additional info.
How we protect your data
The controls below are defined in our internal security policies and apply to everyone at Summerbase.
Encryption
Data is encrypted in transit with TLS 1.2 or higher over public networks, and by Google Cloud’s network encryption between our services, and at rest with AES-256. Encryption keys are held in managed key and secret services, with restricted, logged access. Integration credentials, such as your Stripe API keys, are stored encrypted, and we request read-only access wherever the integration supports it.
Access control
Multi-factor authentication on every system and single sign-on where supported, least-privilege permissions, and access reviews twice a year. Access is removed promptly when someone leaves.
Secure development
Every change ships through our deployment pipeline after automated tests, dependency scanning and secret scanning pass. Nobody deploys to production by hand.
Monitoring and logging
Audit logs of infrastructure changes and production access are retained and monitored, with alerts on permission changes and production access.
Vulnerability management
Continuous scanning of code, dependencies and infrastructure, with critical issues fixed within 7 days.
Backups and recovery
Customer data is backed up regularly and encrypted, and backups are tested by restore at least once a year. Production runs across multiple zones.
Incident response
A documented incident response plan, tested yearly. If a breach affects your data, we notify you without undue delay.
People
Everyone signs confidentiality agreements and completes security training at hiring and every year, and staff with access to production systems pass background checks. Company laptops are encrypted.
Vendor management
Vendors handling customer data are reviewed before use and every year, and bound by data processing agreements. We give customers 10 days’ notice before adding a sub-processor.
Security policies
Our security program is governed by the policies below, approved by management and reviewed every year.
- Information Security Policy
- Information Security Roles and Responsibilities
- Acceptable Use Policy
- Access Control Policy
- Asset Management Policy
- Business Continuity and Disaster Recovery Plan
- Code of Conduct
- Cryptography Policy
- Data Management Policy
- Human Resource Security Policy
- Incident Response Plan
- Operations Security Policy
- Physical Security Policy
- Risk Management Policy
- Secure Development Policy
- Third-Party Management Policy
Related: Data Processing Addendum, Sub-processors and Privacy Policy.
Found a vulnerability?
We welcome reports from security researchers. Email security@summerbase.com with details and steps to reproduce; we respond within a reasonable time and will not pursue action against good-faith research. The same contact details are published in /.well-known/security.txt.