Security at Topiq

Your email, calendar and meetings are some of your most sensitive data. We treat them that way.

This page summarizes how Topiq protects customer data: how it is isolated, encrypted, accessed, monitored and recovered, and which providers process it. If you need more detail, we will complete your organization's security questionnaire or walk your team through our controls on a call.

Request security documents Read our Privacy Policy

Security contact: privacy@basiq.work

SOC 2

Readiness underway

Controls designed against the SOC 2 Trust Services Criteria. We do not yet hold a SOC 2 report.

Penetration testing

Third party + in-house

Most recent third-party test by Aikido Security, March 2026. Report available on request.

Security breaches

None to date

Customers notified within 72 hours of a confirmed personal data breach.

Customer data used to train AI

Never

Pre-trained models only, under provider terms that prohibit training on our API data.

Compliance & assurance

Our controls are designed against recognized frameworks today, and we are working toward independent attestation.

SOC 2

Readiness underway

We are preparing for a SOC 2 audit and selecting an independent audit firm. Our controls are designed against the SOC 2 Trust Services Criteria. We do not yet hold a SOC 2 report or any other third-party security certification, and we will update this page as the audit progresses.

Penetration testing

Third party

An independent penetration test of the application was performed by Aikido Security in March 2026. Alongside it we run recurring in-house security assessments covering authentication, authorization, tenant isolation and integrations. We triage findings by severity and fix them. The third-party report is available on request.

Framework alignment

Our Information Security Program follows the SOC 2 Trust Services Criteria, ISO 27001 Annex A and the NIST Cybersecurity Framework. We are not certified against ISO 27001; we use it, alongside the other frameworks, to design and measure our controls.

Security ownership

Our CTO owns security. That covers architecture review, access policy, incident response and vendor risk. A dedicated information security engineer, engaged part time, provides ongoing review and validation of our systems. Our infrastructure runs entirely on AWS, so it also inherits AWS's SOC 2 Type II and ISO 27001 certified physical and infrastructure controls.

How we protect your data

A summary of the controls behind the platform.

Cloud infrastructure & network

Hosted on AWS in the United States, on Amazon ECS (Fargate) and Amazon RDS for PostgreSQL.
Application containers and the database run in private subnets with no public IP addresses.
Internet traffic reaches the application only through a TLS load balancer protected by AWS WAF.
Security groups permit only the ports and sources each service needs, and all infrastructure is defined in code (Terraform).

Encryption & secrets

Client connections use TLS 1.2 or 1.3, and application connections to the database use TLS.
The database and its backups are encrypted at rest with AWS KMS.
OAuth tokens for connected services are encrypted at the application layer before they are stored.
Application secrets are kept in AWS Systems Manager Parameter Store and Secrets Manager and injected at runtime, never stored in code.

Tenant isolation & access

Each workspace's data is logically separated: records are tied to their workspace, and queries are scoped to the signed-in user's workspace.
Uploaded files, such as CSV imports, are processed in memory and not stored.
Role-based access (owner, admin, member) is enforced server-side on every request.
Production access is limited to named Basiq personnel bound by confidentiality obligations.

Authentication

Customers sign in with SSO only, through Google or Microsoft (OIDC), so we never store user passwords.
Sessions use short-lived access tokens, and signing out revokes the session's refresh token.
Engineers reach production cloud accounts only through MFA-protected, short-lived role sessions.
Our CI/CD pipeline authenticates to AWS with OIDC federation, not stored access keys.

Secure development

Application changes must pass automated tests before merging, and infrastructure changes require an approving review and signed commits.
Secret scanning (gitleaks) runs in pre-commit hooks and in CI.
Container images are stored with immutable tags and scanned for vulnerabilities on push.
We deploy to production only through automated CI/CD.

Monitoring & incident response

Application and load-balancer logs are centralized, with alert rules that page on-call engineers.
The production database is reachable only over a private network, with short-lived per-engineer credentials instead of a shared password.
Sign-ins, membership changes and role changes are recorded in an application audit log.
Customers are notified within 72 hours of a confirmed personal data breach, as committed in our DPA.

Backup & resilience

Automated daily database backups with 7-day point-in-time recovery, encrypted with AWS KMS.
A database snapshot is taken automatically before production schema changes.
Deletion protection is on, and a final snapshot is required before a database can be deleted.
Infrastructure is defined in code, so environments can be rebuilt from source.

People

All personnel, including contractors, sign confidentiality agreements and our Acceptable Use Policy.
Everyone completes security onboarding with our CTO. Engineers also complete secure-coding training.
All credentials are managed in 1Password, and SSH keys never sit on disk as plaintext.

Endpoints

Company-issued macOS devices only. Personal devices (BYOD) are not allowed for employees.
Every device has full-disk encryption, a firewall, auto-lock and automatic security updates enabled.
Lost or stolen devices can be locked or wiped remotely.

Privacy & responsible AI

AI is central to Topiq. Here is how we keep it from becoming a risk to your data.

Your data stays yours

You own and control your data. We process it only to provide the service.
We do not sell personal information. Basiq personnel access customer data only to provide support, secure the service or comply with law.
We help you answer access, export and deletion requests within 30 days, as described in our DPA.
Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Read our Privacy Policy

AI governance

We use pre-trained models from Anthropic and OpenAI, accessed directly or through Musal, our affiliated AI orchestration platform. We never train or fine-tune models on customer data.
Each AI request carries only the context the feature needs, from a single workspace.
Our AI providers' commercial API terms prohibit them from training on our API data.
Prompts are versioned and evaluated in Musal before release. AI assists users and is not used for decisions with legal or similarly significant effects.

Subprocessors

We keep our vendor footprint small. The current list is kept at gettopiq.ai/subprocessors, and changes follow the notice process in our DPA.

Provider	Purpose	Data handling
Amazon Web Services	Hosting, storage, backups, logging	All Customer Content (US)
Anthropic	Large language model inference	Transcript, email and message text and record context sent in prompts (US)
OpenAI	Large language model inference for specific workflows	Same as above, for those workflows (US)
Musal (affiliate of Basiq)	Prompt orchestration and model routing to the providers above	Prompt content as above (US)
Recall.ai	Meeting notetaker, recording and transcription	Meeting audio and video, participant names, transcript. Recording media is deleted at Recall.ai when a workspace is purged. (US)
Elastic	Logging and metrics for the platform services	Application logs and metrics (US)
ZeroBounce	Email address verification	Contact email addresses (US)
Trestle	Phone number validation	Contact phone numbers (US)
Propelr	Monitoring prospects' public LinkedIn posts	Prospect LinkedIn profile URLs; public post content is returned (US)
Instantly	Outbound email campaign delivery and reply capture, for workspaces using Basiq's account	Lead name, email, company, outbound email content and replies (US)
Serper	Web search for contact and company research	Person and company names used in search queries (US)
GitHub	Tracking product feedback and bug reports submitted inside the app	The report text and the names of any account, contact or deal it refers to (US)
Stripe	Invoicing and payment processing	Billing contact and payment details (held by Stripe) (US)
Google, Microsoft, Zoom	Calendar, email and meeting integrations each User connects	Accessed with that User's own authorization, which they can revoke at any time

AI processing currently takes place in the United States. All data sent to subprocessors is encrypted in transit.

Security documentation

Our Privacy Policy, Terms of Service and DPA are public. The other documents are available to customers and prospects on request; some may require a mutual NDA.

Penetration test report

Summary of our most recent third-party test (Aikido Security, March 2026)

On request

Security practices overview

A written overview of our current security controls

On request

Your security questionnaire

We are glad to complete your organization's questionnaire

On request

SOC 2 report

Will be available after an independent audit is complete

Coming