Security at ExpiryEdge
How we protect your compliance data
ExpiryEdge runs on Google Cloud and Firebase. On top of that we separate every customer’s data, enforce roles on our servers and record important actions in an audit log. This page explains what we do today.
Visit the Trust centerHow we protect your data
The main protections in place today.
Encryption
Connections use HTTPS (TLS) only. Google Cloud encrypts stored data (AES-256). Access tokens for connected tools are additionally encrypted by us (AES-256-GCM).
Google Cloud infrastructure
The service is hosted on Google Cloud and Firebase in the United States. Google’s infrastructure holds certifications such as ISO 27001 and SOC 2; these cover Google, not ExpiryEdge itself.
Sign-in and two-step verification
Sign in with email and password, Google or Microsoft. Anyone can turn on two-step verification with an authenticator app, and admins can require it. Single sign-on (SAML) is planned.
Roles and permissions
Admin, editor and viewer roles are checked on our servers for every request, so hiding a button is never the only protection.
Separation between customers
Each request is checked against the organization of the signed-in user. Records of other organizations behave as if they do not exist. Database rules apply the same separation.
Session controls
Admins can set an idle timeout and a maximum session length. Removed or deactivated users lose access within about a minute.
Audit log
Changes, sign-ins and security settings are recorded in an activity log that users cannot edit. Kept for 12 months by default, with export and a tamper check.
Backups
The database is exported every day to a separate storage bucket, and a written restore procedure exists.
Your data stays yours
Admins can export all of the organization’s data at any time. Enterprise customers can also set retention rules and legal holds.
Enterprise mode
Switches off analytics, session recording and marketing messages in the app for the whole workspace. On by default for the Enterprise plan.
Controlled staff access
Our internal admin tool requires a named staff account with two-step verification, and every access to a customer workspace is logged.
Responsible disclosure
Security researchers can report issues privately to security@expiryedge.com. We do not take action against good-faith research.
Certifications
An honest snapshot of where we stand. We update it whenever something changes.
Last reviewed: October 2026SOC 2 Type I
In preparation. We will publish the auditor and report date here when the audit is complete.
SOC 2 Type II
Planned after Type I.
ISO 27001
Not certified. Our cloud provider, Google Cloud, holds its own ISO 27001 certification.
HIPAA
We do not sign Business Associate Agreements today.
Independent penetration test
Not done yet. We will share the summary with customers under NDA once it is done.
GDPR data processing agreement
We act as processor for your workspace data. A data processing agreement is available on request.
If something goes wrong
We follow a written incident response plan. If a security incident affects personal data that you are responsible for, we tell your account admins without undue delay, so you can meet your own legal deadlines (for example the 72 hours under GDPR Article 33). We tell you what happened, which data is affected, what we have done and what you should do.
Reporting a vulnerability
If you found a security issue in ExpiryEdge, please report it privately to security@expiryedge.com. Include the affected URL or component, steps to reproduce and the impact you expect. We acknowledge reports within 2 business days, give a first assessment within 5 business days, and aim to fix critical issues within 7 days and high-severity issues within 30 days. We do not run a paid bug bounty.
Sub-processors
We use a small number of providers to run the service, such as Google Cloud, Stripe and our email providers. The full list, with location and whether each one is used in Enterprise mode, is on our sub-processors page.
See all sub-processorsSecurity questions
Short answers to common questions.
Your workspace data is stored on Google Cloud in the United States. Daily backup copies are kept in a separate storage bucket in the European Union. Hosting in the EU is planned but not available yet.
Yes. Data is encrypted in transit with HTTPS (TLS) and at rest by Google Cloud (AES-256). Access tokens for connected tools such as Asana and ClickUp are additionally encrypted by us.
Only people in your organization, according to the role you give them (admin, editor or viewer). Our internal admin tool, which our staff use for support, requires two-step verification and logs every access to a customer workspace. We do not sell your data.
Not yet. Single sign-on (SAML / OIDC) and automatic user provisioning (SCIM) are planned. Today you can require two-step verification for everyone in your workspace.
Admins can export all of the organization’s data at any time, including before cancelling. To have your data deleted, contact support@expiryedge.com. We handle deletion requests within 30 days.
Questions about security?
We are happy to answer questions and to send our security pack for your review.
Security: security@expiryedge.com
Support: support@expiryedge.com