Trust
Security
How we protect your code, your prompts, and your team. Every claim on this page is one you can verify or ask us to evidence.
Encryption
TLS 1.2+ in transit, with HSTS on goatfied.com and the API. AES-256 at rest with AWS KMS-managed keys. Every credential you give us — environment secrets, connector tokens, webhook secrets, GitHub sign-ins — is sealed under its own data key that only unwraps for your workspace. Enterprise owners can use their own AWS KMS key instead and revoke our access at any time, which makes those credentials unreadable to us.
Isolation
Each tenant lives in a logically isolated namespace with per-tenant IAM scoping. Agent runs execute in ephemeral sandboxes with short-lived, repo-scoped credentials — never an org-wide token. Privacy-mode workspaces have the code a cloud agent read removed from its transcript as soon as the run ends.
Zero retention by default
On Free and Pro, prompts and completions are dropped once the request finishes. We do not train on your code. Audit logs contain metadata only — who, when, which model, how many tokens — never content.
Teams and Enterprise can enforce privacy mode organisation-wide so the setting cannot be disabled per seat.
Data residency
Goatfied runs in AWS us-east-1 (N. Virginia), and your data is stored there. EU data residency isn't available yet; if you need it, tell us at enterprise@goatfied.com.
Compliance
- SOC 2 Type II — not yet audited. We will publish the audit window here once an auditor is engaged.
- GDPR / UK GDPR / CCPA — our DPA is available for self-service execution.
- HIPAA — not supported today. Do not submit PHI.
- ISO 27001 — on the roadmap; not yet certified.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
Sub-processors
Every third party that may process customer data is published at goatfied.com/docs/subprocessors. We give notice before adding a new one.
Disclosure
Report a vulnerability to security@goatfied.com. PGP key available on request. We acknowledge within 24 hours and will not pursue legal action against good-faith research that respects user privacy and avoids service degradation.
Status
Live availability: status.goatfied.com.
Questions
Security reviews, questionnaires and architecture calls: enterprise@goatfied.com.