Security Policy
This Security Policy describes the technical and organisational measures ÍøÆØ³Ô¹Ï uses to protect customer data in the hosted ÍøÆØ³Ô¹Ï platform. It is the description of security measures referenced by ÍøÆسԹÏ's Data Processing Addendum (Annex II of the EU Standard Contractual Clauses).
5.1 Hosting and Data Location
ÍøÆØ³Ô¹Ï runs on Amazon Web Services ("AWS"), with AI and analytics services hosted on Google Cloud Platform. Customer data is stored in the United States (AWS US East) by default. Hosting in other regions may be supported where contractually agreed.
ÍøÆسԹÏ's integrations platform uses Microsoft Azure to connect ÍøÆØ³Ô¹Ï with customers' on-premise systems. AWS, Google Cloud and Microsoft each publish SOC 2 Type II and ISO 27001 attestations through their own compliance programs. The current list of ÍøÆسԹÏ's sub-processors and their data locations is maintained at https://trust.mosaicapp.com (see Section 5.12).
5.2 Security Operations and Monitoring
ÍøÆسԹÏ's security team is responsible for the protection of customer data and of the operational systems that support the ÍøÆØ³Ô¹Ï platform.
Production access, administrative actions, network events and authentication events are logged centrally and monitored continuously. Threat detection across ÍøÆسԹÏ's cloud accounts feeds a central security information and event management (SIEM) platform, and failures of critical security controls raise alerts that are triaged under ÍøÆسԹÏ's Incident Response Plan. Systems are patched on the timelines set out in Section 5.11.
5.3 Backups
ÍøÆØ³Ô¹Ï performs automatic backups of all customer and system data every day. Backups are encrypted using the same controls applied to live production data and are monitored; a failed backup raises an incident alert. Backups are retained in accordance with ÍøÆسԹÏ's Data Retention Policy and are purged within 180 days after an account's data is removed from the system (see Section 5.10).
5.4 Security Controls
ÍøÆØ³Ô¹Ï uses multiple layers of technical and procedural controls to protect customer data, including:
Infrastructure
- Network segmentation and VPC firewalls
- Web application firewall
- Managed threat detection across cloud accounts
- Centralized log management and SIEM
- Least-privilege identity and access management; no shared or default accounts on production systems
- Encryption in transit and at rest (Section 5.8)
Application and development
- Every code change is reviewed before release
- Automated dependency and static code scanning on every change
- External vulnerability scanning of internet-facing infrastructure
- Separate development and production environments
- Documented change management for customer-impacting changes
People
- Background checks for all employees, as permitted by law
- Security awareness training within 30 days of hire and annually thereafter
- SSO and/or multi-factor authentication on all internal systems that support it
- Managed, monitored endpoints with endpoint protection
- Regular access reviews with removal of unneeded access
For your users
- Two-factor authentication, single sign-on and role-based permissions (Section 5.7)
5.5 Independent Assurance
ÍøÆØ³Ô¹Ï completes a SOC 2 Type II examination every year through an independent CPA firm, covering a twelve-month observation period. The current SOC 2 report, ÍøÆسԹÏ's Data Processing Addendum and ÍøÆسԹÏ's security policies are available through https://trust.mosaicapp.com.
ÍøÆØ³Ô¹Ï processes customer data as a processor under the GDPR. ÍøÆسԹÏ's Data Processing Addendum sets out the processor terms, sub-processor notice period and security incident notification commitments described on this page.
5.6 What You Can Do
Security is a shared responsibility. ÍøÆØ³Ô¹Ï recommends that every customer:
- Turn on two-factor authentication for all users, and single sign-on where available (Section 5.7).
- Give each person the least-privileged ÍøÆØ³Ô¹Ï role they need, and remove access promptly when people leave.
- Keep devices patched and protected with up-to-date endpoint security. Security of your devices is the responsibility of you and your IT provider.
- Report anything suspicious to support@mosaicapp.com.
If a device is lost or compromised, your data remains protected on ÍøÆسԹÏ's servers; sign in from a new device and rotate the affected password.
5.7 Signing In
Passwords should include upper- and lower-case letters, a number and a symbol; they are never stored or transmitted in plain text.
Two-factor authentication is available to every customer. A team administrator turns it on in Team Settings → Security and can either require a specific method for all users (an authenticator app, which we recommend, or SMS) or let each user choose. Single sign-on using SAML 2.0 is configured by a team administrator in the same place, including verification of your email domain; when SSO is enabled, authentication (including any multi-factor step) is handled by your identity provider.
5.8 Data Encryption
Data in transit between your browser and ÍøÆسԹÏ, and between ÍøÆØ³Ô¹Ï services, is protected with Transport Layer Security (TLS) 1.2 or higher. Data at rest is encrypted with AES-256. Encryption keys are held in cloud key-management services (AWS KMS, Google Cloud KMS), and are managed and rotated in accordance with ÍøÆسԹÏ's Encryption Policy.
5.9 Service Availability and Continuity
ÍøÆØ³Ô¹Ï is designed for high availability and is deployed across multiple AWS Availability Zones by default. Live service status, incident history and 90-day uptime for every component are published at https://status.mosaicapp.com, where you can subscribe to updates by email, Slack or RSS.
ÍøÆØ³Ô¹Ï maintains Business Continuity and Disaster Recovery plans that define recovery objectives for each system component. The plans are tested at least annually. ÍøÆØ³Ô¹Ï is not responsible for delays resulting from AWS, Google Cloud or other provider downtime.
5.10 Data Retention and Deletion
Your data remains in ÍøÆØ³Ô¹Ï while your account is active. When an account is closed in good standing, its data is retained for 180 days and then permanently deleted; you can export your data at any time through the application or the Open API before then. Backups containing deleted data are purged within 180 days of deletion. The full retention terms, including accounts not in good standing, are in Section 1.6.7 of the Terms of Use.
5.11 Vulnerability Management and Responsible Disclosure
ÍøÆØ³Ô¹Ï scans continuously for vulnerable dependencies and insecure code on every change, and scans its external infrastructure at least quarterly. Findings are tracked to closure against the following timelines:
- Critical: 5 business days
- High: 30 business days
- Medium: 60 business days
- Low: 90 business days
No software is deployed to production with an unresolved Critical or High finding unless a documented, approved exception is in place.
To report a vulnerability, email security@mosaicapp.com. ÍøÆØ³Ô¹Ï acknowledges reports within 2 business days and, after triage, shares an expected remediation timeline. See ÍøÆسԹÏ's Responsible Disclosure Policy for scope and safe-harbor terms.
5.12 Sub-processors
ÍøÆØ³Ô¹Ï uses sub-processors to deliver the service. The authoritative list, including data locations, is maintained at https://trust.mosaicapp.com.
ÍøÆØ³Ô¹Ï gives at least 14 days' notice before a new sub-processor processes customer personal data, and customers may object on reasonable data-protection grounds, as set out in the Data Processing Addendum.
ÍøÆØ³Ô¹Ï and Your Data Security Responsibilities
6.1 Authorization
If you provide ÍøÆØ³Ô¹Ï any personal or sensitive data relating to other individuals, either directly, through our websites, through our software, or otherwise, you represent that you have the authority to do so and permit us to use, access, or host that data in accordance with this policy, the Terms of Use and the Privacy Policy.
6.2 Account Access
ÍøÆØ³Ô¹Ï employs industry-standard security measures to ensure the security of information. However, the security of information transmitted through the Internet can never be guaranteed. ÍøÆØ³Ô¹Ï is not responsible for any interception or interruption of any communications through the Internet or for changes to or losses of information. Users are responsible for maintaining the security of any password, user ID, or other forms of authentication involved in obtaining access to password protected or secure areas of any ÍøÆØ³Ô¹Ï websites.
6.3 Security Incident Notification
If ÍøÆØ³Ô¹Ï confirms a security incident involving your data, ÍøÆØ³Ô¹Ï will notify your designated contact in writing without undue delay and no later than 24 hours after discovery. The notification will include, to the extent then known: the categories and approximate number of data subjects and records affected; the nature of the incident and its known or estimated time frame; the categories of data involved; the identity and contact details of ÍøÆسԹÏ's incident representative; the likely consequences; and the measures taken or proposed to mitigate the incident, with recommended steps for you. ÍøÆØ³Ô¹Ï will provide updates as further details are validated.
To protect you and your information, ÍøÆØ³Ô¹Ï may suspend access to the service, without notice, pending an investigation, if any breach of security is suspected. Unauthorized access to password-protected or secure areas of any ÍøÆØ³Ô¹Ï website is prohibited and may lead to criminal prosecution.
If you have reason to believe that your account or our service is no longer secure, contact support@mosaicapp.com immediately. To report a suspected vulnerability, contact security@mosaicapp.com (Section 5.11).
6.4 Use of Information
How ÍøÆØ³Ô¹Ï collects, uses and discloses personal information is described in the ÍøÆØ³Ô¹Ï Privacy Policy (/privacy-policy).
Last Updated Date: 09/30/2026