Security

Encryption

• Data in transit is encrypted (TLS/HTTPS)
• Sensitive data at rest is encrypted
• Session cookies use HttpOnly and Secure flags

Access Controls

• Authentication via Google OAuth — we never see or store your password
• Role-based access within each organization
• Customer data is scoped per organization; access controls and authentication govern who can reach it

Infrastructure

Cofactor is hosted on Amazon Web Services (AWS).

Compliance Program

Treebeard is building out a security and compliance program covering SOC 2 and HIPAA. Current status:

• SOC 2 Type II — an external audit is in its observation period (started July 2026); the audit is not yet complete
• HIPAA — we are actively working toward HIPAA compliance (policies, incident response and breach notification procedures, and access controls are in progress); we are not yet HIPAA compliant and have not been independently audited against HIPAA

We do not yet hold a completed third-party certification for either framework — this section will be updated as that changes. For our current compliance status or a report once available, contact us at hello@runcofactor.com.

Data Retention

• Account data: retained until account deletion
• Test data and results: retained according to your organization's settings
• Usage logs: retained for up to 12 months
• Error logs: retained for up to 90 days

Subprocessors

We share information with the following categories of service providers:

• Google — authentication (Google OAuth)
• OpenAI — AI-powered features
• Sentry — error tracking and performance monitoring
• Cloud infrastructure providers — hosting (see Infrastructure above)

See our Privacy Policy for the full list and how each is used.

Status & Uptime

Real-time and historical uptime for Cofactor is available at status.runcofactor.com.

Reporting a Security Issue

If you believe you've found a security vulnerability in Cofactor, email us at hello@runcofactor.com and we'll respond promptly.

Learn More

See our Privacy Policy and Terms of Service for the full legal terms governing data handling on Cofactor.