Trust, demonstrated in the open.
Building a compiler the world can trust means showing the work. We publish our live correctness benchmarks, our security model, and our compliance status, measured against the same standards we hold ourselves to.
Trust, by category
The controls, documents and commitments behind our trust posture, grouped by category.
Risk Profile
Our overall risk posture: the data we touch, where it lives, and the controls that sit behind every category on this page.
Product Security
How the product is built and shipped securely, secret-less CI, code review, dependency and supply-chain controls.
Reports
Audit reports, penetration test summaries and security assessments, available on request.
Data Security
Encryption in transit and at rest, key management, backups and data segregation.
Legal
Data Processing Agreement, terms, subprocessor commitments and regulatory alignment.
Data Privacy
GDPR and CCPA alignment, data residency, retention and deletion, and our Data Protection Officer contact.
Access Control
Authentication, least-privilege authorization, MFA and periodic access reviews.
Infrastructure
Hosting, network controls, segmentation and our EU-first provider footprint.
Endpoint Security
Device hardening, disk encryption, patching and endpoint monitoring.
Corporate Security
Security training, onboarding and offboarding, and vendor risk management.
Policies
The internal policies and standards that govern how we operate.
Subprocessors
The third parties that may process customer personal data on our behalf. We notify customers in advance before a new subprocessor takes effect, and customers may object under the Data Processing Agreement.
| Subprocessor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| IONOS IONOS SE · Montabaur, DE | Bare-metal hosting for customer applications & data | Germany / EU | Not required, EU processing |
| Amazon Web Services AWS EMEA SARL · Luxembourg | Bare-metal hosting for customer applications & data | EU regions | EU SCCs + EU-US DPF |
| Google Cloud Google Ireland Ltd. · Dublin, IE | Bare-metal capacity & on-demand burst VMs | EU | EU SCCs + EU-US DPF |
| Cloudflare Cloudflare, Inc. · US | CDN, DDoS protection / WAF, Workers & KV | Global edge network (incl. EU) | EU SCCs + EU-US DPF |
| Subprocessor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Microsoft 365 Microsoft Ireland Operations Ltd. · Dublin, IE | Email (Exchange Online), Office & document editing | EU | EU SCCs + EU-US DPF |
| Stripe Stripe Payments Europe, Ltd. · Dublin, IE | Payment processing, billing & invoicing | EU (some processing via Stripe, Inc., US) | EU SCCs + EU-US DPF |
| PostHog PostHog, Inc. · EU Cloud | Product & web analytics | EU, AWS eu-central-1 (Frankfurt) | EU SCCs |
| Notion Notion Labs, Inc. · US | Internal knowledge management | USA | EU SCCs + EU-US DPF |
| Resend Resend, Inc. · US | Transactional email delivery | AWS infrastructure (region per Resend's subprocessor list) | EU SCCs |