Security
How we protect your clients’ data, and what is still in progress.
Citron holds enquiries, bookings and customer records, so you should know exactly how they are protected. Here is what is in place today and what we are still working on, without rounding up.
SOC 2: readiness, not certification
Citron is not SOC 2 certified and has not been audited. We completed a gap assessment against the Security, Availability and Confidentiality criteria in September 2026 and are working through it toward a Type I audit.
Customers and prospects can ask for the full gap assessment.
In place today
Tenant isolation
Every workspace is separated in the data layer, and an automated test suite checks the isolation against a real database on every change.
Encryption
TLS for all traffic. Connector credentials are encrypted with AES-256-GCM using per-workspace keys and are never returned by the API. API keys are stored hashed.
Two-factor sign-in
Authenticator-app 2FA with hashed recovery codes, re-authentication for sensitive actions, and a workspace setting to require 2FA for every member.
Roles and access rules
Permissions checked on every request, custom roles, and record- and field-level access rules on Agency and Enterprise.
Audit log
Administrative and security events (sign-ins, 2FA, agency access, exports) are recorded and can be exported or streamed to a SIEM.
Signed links and webhooks
Webhooks are signed with HMAC-SHA256. Approval, export and case-study links are signed, expire and serve one purpose.
Outbound request guard
Requests to connected systems are checked so they cannot reach internal addresses.
Console hardening
A strict, nonce-based Content Security Policy, HSTS and framing protection on the console.
Stage before production
Every change goes through a staging environment and automated checks (type checks, unit, contract and isolation tests) before it reaches production.
Readiness summary
The main items from our SOC 2 gap assessment and where they stand.
| Continuous integration on every change | In place | Type checks, tests and builds run on every pull request in all repositories. |
|---|---|---|
| Error monitoring | In progress | Built into the API and console with personal data scrubbed; alerting and paging are being set up. |
| Backups and restore drills | In progress | Nightly database backups run in production and are kept for 14 days. A full restore was tested on 31 October 2026. Encrypted off-site copies are built and not switched on yet. |
| Incident response | In progress | Severity levels and runbooks are written; on-call rota and a tabletop exercise are next. |
| Mandatory two-factor sign-in | In progress | Required for owners and platform staff, with a 14-day grace period; being switched on in production. |
| Written security policies | Planned | Information security, access control, change and vendor management policies. |
| Dependency and container scanning | Planned | To be added as required checks in CI. |
| Independent penetration test | Planned | Scoped; scheduled after the current hardening work. |
Where data lives
The application, its databases and uploaded files are hosted by Hetzner in Finland and Germany (EU). A workspace owner can export all of its data in open formats at any time.
Sub-processors
| Hetzner Online GmbH | Hosting of the application, databases and uploaded files | Finland and Germany (EU) |
|---|---|---|
| Stripe Payments Europe Ltd. | Billing and payments | Ireland (EU), USA |
| Resend Inc. / Zoho Corporation | Transactional email | USA / EU |
| Anthropic PBC | AI features in the console: the assistant, reply drafts and translation | USA |
| Eleven Labs Inc. | Speech-to-text for dictation | USA |
| Cloudflare Inc. | Bot protection on public forms, DNS | Global |
| Functional Software Inc. (Sentry) | Error reporting, only when enabled | USA / EU |
From the draft data processing agreement, which is under legal review.
Report a vulnerability
If you think you have found a security issue, email us with the details and how to reproduce it. Please give us a reasonable time to fix it before disclosing it publicly.