Security and compliance, written down.
What Amba does to protect customer data, the controls we have today, and the work in flight. We’d rather show you our actual posture than market our way past your security review.
Where we are. Where we’re going.
Some controls are live today. Some are work in flight. We label everything honestly so your security review starts with the facts.
Who touches your data.
We use these third parties to deliver the service. Each has an executed DPA on file; click through to read their public commitments.
Changes to this list are announced 30 days in advance via email to billing contacts on record. Customers under signed MSA receive the same notice via their account team.
How your data is stored, moved, and destroyed.
Project databases and backups are stored in the US.
AES-256, provided by every sub-processor that stores customer data.
Public endpoints serve HTTPS with managed TLS certificates. Internal workflow traffic runs on a private network.
Physical isolation per project. Each project receives its own dedicated database — no shared schemas, no row-level filtering, no logical-only isolation.
30-day retention after account deletion. Certified destruction reports available on request.
90-day default retention. Extended retention (up to 7 years) available for Enterprise.
Point-in-time recovery on every tenant database. 7-day window on Pro, 30-day on Scale, configurable on Enterprise.
The controls behind the controls.
security@amba.dev is the inbound channel. Coordinated disclosure timeline standard. No legal action against good-faith research.
Security contacts are published in RFC 9116 format at amba.dev/.well-known/security.txt.
MFA enforced on 100% of team members. Production access requires elevated approval with just-in-time provisioning. Quarterly access reviews.
Annual third-party penetration tests. Most recent summary available under NDA to Enterprise customers.
Code review on every change, automated security scanning in CI, dependency auditing on every build. Internal CSO posture report published monthly.
When something goes wrong.
Customers notified within 24 hours of any security incident affecting their data. Notification covers what we know, what we don’t, and what we’re doing.
Initial human response within 30 minutes. Incident commander assigned. Post-mortem published within 7 days.
Reach the right inbox.
Trust questions get answered by humans. We aim for a same-business-day first response.