## **Certified and continuously monitored.** Our compliance posture is verified by independent auditors, not just self-assessed. ### SOC 2 Type II Independently audited for security, availability, and confidentiality controls over an extended observation period. Report available on request. shield-check Continuous Monitoring Our security posture is monitored 24/7 via Oneleet. Controls are tested continuously, not just once a year at audit time. shield GDPR-Ready We honor data subject rights including access, rectification, and deletion. Data processing agreements are available for all customers. ## **Built for enterprise security requirements.** Every layer of the stack is designed to protect your data. lock ### Encryption Everywhere All data is encrypted at rest with AES-256 and in transit with TLS 1.2+. Database backups, file storage, and inter-service communication are all encrypted by default. key ### Access Controls Role-based access control and enforced multi-factor authentication. Least-privilege principles govern every internal and external access path. laptop ### AWS Infrastructure Hosted on AWS with SOC 2 compliant infrastructure. Isolated compute and storage environments ensure strict tenant separation across all workloads. shield-check ### Monitoring & Incident Response Real-time monitoring, structured logging, and automated alerting. Our incident response process covers detection, containment, and customer notification. shield ### Vendor Management Every third-party vendor is assessed against SOC 2 criteria before onboarding. Critical vendors are reviewed annually for continued compliance. lock ### Data Privacy Clear data retention policies, right to deletion, and GDPR-ready data handling. We collect only what is necessary and delete what is no longer needed. ## **An engineering-first team.** Built by people who have shipped security-critical systems at scale. Warp was founded by engineers and built by a team from Ramp, Brex, Stripe, and Palantir. Companies where security is a prerequisite, not a feature. We carry that standard into every line of code we ship. Our codebase is modern with no legacy technical debt. We chose our stack specifically for security and reliability: strict TypeScript, Effect for type-safe business logic, and infrastructure-as-code for reproducible, auditable deployments. Every engineer at Warp owns security. We run automated dependency scanning, static analysis, and infrastructure audits as part of our CI pipeline, not as a quarterly checkbox exercise. ## **Backed by the best.** Technical founders and investors who built iconic, security-conscious companies. Drew Houston CEO, Dropbox Balaji Srinivasan Ex-CTO, Coinbase Elad Gil Investor Arash Ferdowsi Co-founder, Dropbox Kyle Vogt Founder, Cruise Kevin Hartz Founder, Eventbrite & A* Capital Amjad Masad Founder, Replit Jordi Hays Founder, TBPN Sound Ventures Fund Y Combinator Fund Homebrew Fund HOF Capital Fund ## Security FAQ ### 01. Is Warp SOC 2 compliant? Yes. Warp has completed a SOC 2 Type II audit, which evaluates the design and operating effectiveness of our controls over an extended period. Our report is available upon request through our Trust Center. ### 02. Where is my data stored? All customer data is stored in the United States on AWS infrastructure. Data is encrypted at rest using AES-256 and in transit using TLS 1.2+. We use isolated environments to ensure tenant separation. ### 03. How do you handle security incidents? We maintain a documented incident response plan that covers detection, containment, eradication, and recovery. Affected customers are notified promptly in accordance with applicable regulations and our contractual commitments. ### 04. Can we request a security review or penetration test report? Yes. Enterprise customers can request access to our most recent penetration test results, SOC 2 report, and other security documentation through our Trust Center or by contacting your account manager. ### 05. Do you sign BAAs for HIPAA compliance? Yes. We sign Business Associate Agreements for customers on our Enterprise plan who require HIPAA compliance. Contact our team to discuss your specific requirements. ### 06. How do you vet third-party vendors? All third-party vendors undergo a security assessment before onboarding, and critical vendors are reviewed annually. We evaluate each vendor against SOC 2 criteria, data handling practices, and access controls. ### 07. Who is your compliance vendor? We use [Oneleet](https://www.oneleet.com/) to monitor our compliance. ### 08. Where are you based? The entire company is based out of New York City, NY. Need more details? [Visit our Trust Center](https://trust.joinwarp.com/) or [request a demo.](https://www.warp.co/demo) ## Ready to see Warp in action? Talk to our team about your security requirements and see how Warp protects your data. [Request a Demo](https://www.warp.co/demo)