Trust Center

HTTPS everywhere via Let’s Encrypt; HSTS (max-age 1 year, includeSubDomains) enforced at the proxy on every response. Run the live SSL Labs scan below any time to confirm.

Maps to: SOC 2 CC6 · ISO 27001 A.8

X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy set at the proxy on every response — including 4xx/5xx error pages.

Maps to: SOC 2 CC6

Per-request nonce CSP enforced in production on Content-Security-Policy (not Report-Only); genuine violations still stream to /csp-report. Confirm with the live header scans below.

Authentication delegated to AWS Cognito; we never store password hashes ourselves.

Maps to: SOC 2 CC6 · ISO 27001 A.5.16

Postgres row-level security keyed on organization id, enforced in every data query.

Maps to: SOC 2 CC6 · ISO 27001 A.8.3

All data is encrypted at rest. Upload buckets (content + audio + wake-word voice samples) use SSE-KMS under our own dedicated customer-managed key (CMK), with S3 Bucket Keys enabled, public access blocked and versioning on; the database (RDS) is encrypted with AWS-managed keys. Verifiable via the bucket-encryption checks in our runbook.

Maps to: SOC 2 CC6 · ISO 27001 A.8.24

One server-side validator on every upload route: magic-byte sniffing, active-content scans, filename sanitisation.

All secrets load from AWS Secrets Manager via a single loader; none in source or env files.

Maps to: SOC 2 CC6 · ISO 27001 A.8.24

Every privileged action writes an immutable audit row; retained 7 years.

Maps to: SOC 2 CC7 · ISO 27001 A.8.15

Published data categories, legal bases, retention windows, and data-subject rights. Not yet reviewed by external counsel.

Maps to: GDPR · CCPA

Public list of every third party that receives user data, with purpose and region, grouped by the commitment each group actually carries: processors we engage and instruct; third parties your own browser or device reaches on your behalf, which we cannot instruct; sites we fetch a link from because you saved it; and parties announced before they have received anything — today, our payment provider.

Maps to: GDPR Art. 28

A separate, opt-in collection of short voice recordings used for one purpose: training the “Hey Muzings” wake word, so the app can be started hands-free. It is not speaker identification — the recordings are not used to tell one voice from another, are not used to train any other model, and are not shared outside Muzings. They are stored under a one-way pseudonym with no account or organisation identifier attached, kept for 180 days from the date consent is given, and deleted on request from a control in Settings → Privacy. Nothing is recorded unless you accept that disclosure first, and declining changes nothing else about the app.

Maps to: GDPR Art. 5 · GDPR Art. 13 · GDPR Art. 17 · SOC 2 CC9 · ISO 27001 A.5.34

Paid plans will be sold through FastSpring as merchant of record: FastSpring is the seller of that transaction in its own name and is responsible for card handling, sales tax, invoicing and refunds. Card details are entered on FastSpring’s own checkout and never reach our servers or our logs. Not live — billing is switched off, no purchase can be made yet, and FastSpring has received nothing.

Maps to: SOC 2 CC9 · ISO 27001 A.5.19