We treat your revenue data like it's our own. Here's how we protect it — and who we trust to help.
Independently audited annually against security, availability, and confidentiality.
TLS 1.2+ in transit and AES-256 at rest across all data stores.
Enforce SSO, SCIM provisioning, and granular roles on Enterprise.
Multi-region infrastructure with a status page and SLA.
All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Secrets and keys are managed in a dedicated key-management service with strict rotation policies. We minimize the personal data we handle and never require personally identifying end-user fields to operate.
Access to production systems follows least-privilege principles, is gated behind SSO with hardware-backed MFA, and is logged and reviewed. Engineers receive access only to the systems their role requires, and access is revoked promptly on role change or departure.
Belfort runs on hardened cloud infrastructure across multiple availability zones, with network segmentation, automated patching, continuous vulnerability scanning, and daily encrypted backups tested for restoration.
Every change is peer-reviewed and passes automated security checks before deploy. We run regular third-party penetration tests and maintain a formal incident-response plan with defined severities and on-call rotation.
We maintain SOC 2 Type II and support GDPR and UK GDPR compliance through our Data Processing Addendum. Our SOC 2 report is available under NDA to customers and prospects on request.
We use a short list of trusted providers to deliver the Services. Each is bound by data-protection terms at least as protective as our own.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Cloud hosting & storage | US, EU |
| Cloudflare | CDN & edge config delivery | Global |
| Stripe | Payment processing | US |
| Snowflake | Analytics warehouse | US, EU |
| Twilio SendGrid | Transactional email | US |
