Security and compliance, written down.
What Amba does to protect customer data, the controls we have today, and the work in flight. We’d rather show you our actual posture than market our way past your security review.
Where we are. Where we’re going.
Some controls are live today. Some are work in flight. We label everything honestly so your security review starts with the facts.
Who touches your data.
We use these third parties to deliver the service. Each has an executed DPA on file; click through to read their public commitments.
Changes to this list are announced 30 days in advance via email to billing contacts on record. Customers under signed MSA receive the same notice via their account team.
How your data is stored, moved, and destroyed.
US (default). EU + APAC available for Enterprise tenants. Sub-processors are bound to the same residency commitment in writing.
AES-256, provided by every sub-processor that stores customer data. Customer-managed keys (CMEK) available for Enterprise.
TLS 1.3 enforced on every public endpoint. Internal hops are mutually authenticated.
Physical isolation per project. Each project receives its own dedicated database — no shared schemas, no row-level filtering, no logical-only isolation.
30-day retention after account deletion. Certified destruction reports available on request.
90-day default retention. Extended retention (up to 7 years) available for Enterprise.
Point-in-time recovery on every tenant database. 7-day window on Pro, 30-day on Scale, configurable on Enterprise.
The controls behind the controls.
security@amba.dev is the inbound channel. Coordinated disclosure timeline standard. No legal action against good-faith research.
Public program planned Q3 2026. Private invitations on request before launch.
MFA enforced on 100% of team members. Production access requires elevated approval with just-in-time provisioning. Quarterly access reviews.
Annual third-party penetration tests. Most recent summary available under NDA to Enterprise customers.
Code review on every change, automated security scanning in CI, dependency auditing on every build. Internal CSO posture report published monthly.
When something goes wrong.
Customers notified within 24 hours of any security incident affecting their data. Notification covers what we know, what we don’t, and what we’re doing.
Initial human response within 30 minutes. Incident commander assigned. Post-mortem published within 7 days.
Reach the right inbox.
Trust questions get answered by humans. We aim for a same-business-day first response.