Security at Compresr

How we handle your data: infrastructure, access controls, retention, and where we are on compliance.

Compliance status

Compresr is a YC-backed early-stage company. Our SOC 2 Type I audit is in progress through Vanta and has not yet been finalized. We will link the report from this page once it is issued. For procurement or compliance questions, please reach out.

Infrastructure

Encryption in transit

All traffic is served over TLS 1.2+. HSTS is enforced and connections are auto-upgraded to HTTPS.

Encryption at rest

Application data is encrypted at rest by the underlying storage layer. Production secrets are held in a dedicated secrets store with restricted access.

Hosting

Compresr runs on SOC 2-attested cloud infrastructure. Public traffic is protected by DDoS mitigation at the network edge.

API key handling

API keys are stored as SHA-256 hashes only — the plaintext is shown once at creation and never persisted. Keys can be revoked from the dashboard at any time.

Data handling

We log request metadata to power your usage dashboard and billing, and we do not train our compression models on customer requests. For the full breakdown — what we log, per-account-type content handling, and data retention — see our Privacy Policy.

Access controls & operational security

  • Row-level access enforcement in the database: users can only read and write their own data.
  • Role-based access control with server-side authorization for all staff and admin surfaces.
  • Per-key and per-tier rate limiting, enforced atomically.
  • Structured audit logs for auth events, API key changes, payments, and admin actions, with sensitive fields redacted at write time.
  • Webhook payloads are verified via HMAC signatures; payment processing is idempotent.
  • Automated secret scanning on every commit; all CI checks must pass before code reaches production.

Roadmap

What's next on our security and compliance roadmap.

SOC 2 Type I

Audit in progress through Vanta. The report will be published here once finalized.

Reporting a vulnerability

If you believe you have found a security issue in Compresr, please email [email protected]. We aim to acknowledge every report within 48 hours.

Please give us a reasonable window to investigate and fix before any public disclosure.

Last reviewed: July 2026. Have a compliance or procurement question? Get in touch.