Certified and continuously monitored. Our compliance posture is verified by independent auditors, not just self-assessed.
SOC 2 Type II
Independently audited for security, availability, and confidentiality controls over an extended observation period. Report available on request.
shield-check
Continuous Monitoring
Our security posture is monitored 24/7 via Oneleet. Controls are tested continuously, not just once a year at audit time.
shield
GDPR-Ready
We honor data subject rights including access, rectification, and deletion. Data processing agreements are available for all customers.
Built for enterprise security requirements. Every layer of the stack is designed to protect your data.
lock
Encryption Everywhere
All data is encrypted at rest with AES-256 and in transit with TLS 1.2+. Database backups, file storage, and inter-service communication are all encrypted by default.
key
Access Controls
Role-based access control and enforced multi-factor authentication. Least-privilege principles govern every internal and external access path.
laptop
AWS Infrastructure
Hosted on AWS with SOC 2 compliant infrastructure. Isolated compute and storage environments ensure strict tenant separation across all workloads.
shield-check
Monitoring & Incident Response
Real-time monitoring, structured logging, and automated alerting. Our incident response process covers detection, containment, and customer notification.
shield
Vendor Management
Every third-party vendor is assessed against SOC 2 criteria before onboarding. Critical vendors are reviewed annually for continued compliance.
lock
Data Privacy
Clear data retention policies, right to deletion, and GDPR-ready data handling. We collect only what is necessary and delete what is no longer needed.
An engineering-first team. Built by people who have shipped security-critical systems at scale.
Warp was founded by engineers and built by a team from Ramp, Brex, Stripe, and Palantir. Companies where security is a prerequisite, not a feature. We carry that standard into every line of code we ship.
Our codebase is modern with no legacy technical debt. We chose our stack specifically for security and reliability: strict TypeScript, Effect for type-safe business logic, and infrastructure-as-code for reproducible, auditable deployments.
Every engineer at Warp owns security. We run automated dependency scanning, static analysis, and infrastructure audits as part of our CI pipeline, not as a quarterly checkbox exercise.
Backed by the best. Technical founders and investors who built iconic, security-conscious companies.
Drew Houston CEO, Dropbox
Balaji Srinivasan Ex-CTO, Coinbase
Elad Gil Investor
Arash Ferdowsi Co-founder, Dropbox
Kyle Vogt Founder, Cruise
Kevin Hartz Founder, Eventbrite & A* Capital
Amjad Masad Founder, Replit
Jordi Hays Founder, TBPN
Sound Ventures Fund
Y Combinator Fund
Homebrew Fund
HOF Capital Fund
Security FAQ
01. Is Warp SOC 2 compliant?
Yes. Warp has completed a SOC 2 Type II audit, which evaluates the design and operating effectiveness of our controls over an extended period. Our report is available upon request through our Trust Center.
02. Where is my data stored?
All customer data is stored in the United States on AWS infrastructure. Data is encrypted at rest using AES-256 and in transit using TLS 1.2+. We use isolated environments to ensure tenant separation.
03. How do you handle security incidents?
We maintain a documented incident response plan that covers detection, containment, eradication, and recovery. Affected customers are notified promptly in accordance with applicable regulations and our contractual commitments.
04. Can we request a security review or penetration test report?
Yes. Enterprise customers can request access to our most recent penetration test results, SOC 2 report, and other security documentation through our Trust Center or by contacting your account manager.
05. Do you sign BAAs for HIPAA compliance?
Yes. We sign Business Associate Agreements for customers on our Enterprise plan who require HIPAA compliance. Contact our team to discuss your specific requirements.
06. How do you vet third-party vendors?
All third-party vendors undergo a security assessment before onboarding, and critical vendors are reviewed annually. We evaluate each vendor against SOC 2 criteria, data handling practices, and access controls.
07. Who is your compliance vendor?
We use Oneleet to monitor our compliance.
08. Where are you based?
The entire company is based out of New York City, NY.
Need more details? Visit our Trust Center or request a demo.
Ready to see Warp in action?
Talk to our team about your security requirements and see how Warp protects your data.