Security
Built multi-tenant from day one – every workspace isolated, every role enforced on the server, every provider SOC 2 certified. Your data is protected by the same infrastructure that powers the world's leading software companies.
Compliance program
The AI CMO is built and operated by ROGA AI LIMITED, whose SOC 2 Type II and GDPR programs run with Comp AI and cover this product. Policies, monitored controls, framework status and the security questionnaire are published live in the ROGA Trust Center, so procurement and security teams read the same record the auditor does.
Open the ROGA Trust CenterHow we protect your data
AES-256 encryption at rest, TLS 1.2+ in transit. All data encrypted end-to-end.
Multi-factor authentication (TOTP), OAuth sign-in, and short-lived JWT sessions. Our own admin surfaces require MFA – and the check fails closed, never open.
Row-Level Security on every table. Each workspace's data is scoped to its organization, and each brand's data to its profile – in the product and in the data warehouse alike.
Owner, admin, manager, and member roles are checked on the server for every operation – billing, data sources, configuration. A hidden button is never the security boundary.
Platform connections run through SOC 2 OAuth brokers – for proxied connections, tokens are injected server-side and your passwords never pass through us. Card data never touches our servers (Stripe, PCI DSS Level 1).
Webhook ingestion authenticates every request with a per-source secret key, and repeated events never double-count. Your imports stay yours: every batch is listable and deletable, and full account deletion is a request away.
Infrastructure
We build on enterprise-grade infrastructure from providers that maintain the highest security certifications.
GDPR
Our team is ready to answer your security questionnaires and provide detailed documentation.