How we protect your data.

This page is maintained by SOMA to answer common security and privacy questions about the platform. It describes current practices, not a third party certification. For enterprise security documentation, contact security@somaai.earth.

Access & authentication

SOMA accounts are protected by email + password with optional single sign-on for Growth and Scale plans. Sessions expire after inactivity and administrators can revoke access at any time.

Hosting & data residency

All customer data is hosted in the European Union. Databases, object storage and agent runtimes stay within EU regions unless a customer explicitly configures otherwise.

Encryption

Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 managed keys. Secrets and API credentials are stored in an isolated vault.

Data use

Your data is used only to deliver the service you asked for. SOMA does not sell customer data and does not use customer content to train third-party models.

Retention & deletion

You can export or delete your workspace data on request. On account closure, data is removed from active systems within 30 days and from backups within a further 90 days.

Subprocessors & integrations

SOMA relies on a small number of infrastructure providers to run the platform. A current list of subprocessors is available on request from privacy@somaai.earth.

Incident response

Security events are triaged by the SOMA team and, where required, communicated to affected customers without undue delay together with the steps we are taking.

Reporting a vulnerability

If you believe you have found a security issue, please email security@somaai.earth. We investigate every report and will keep you informed as we work through it.