Coff
SECURITY & COMPLIANCE

Security you can see, compliance you can trust

Privacy-first by design — your data encrypted, owned by you, and provably handled the right way, built to meet HIPAA, SOC 2, and GDPR.

GDPR
HIPAA
AICPASOC 2

Encrypted end to end

Your data is protected in transit and at rest — every request, every backup, every byte.

  • TLS 1.2+ on every connection
  • AES-256 at rest and in backups
  • Keys managed and rotated, never exposed

You own your data

Your business data is yours alone — we never sell it, share it, or feed it into model training.

  • Never sold or shared with anyone
  • Never used to train AI models
  • Yours to export or delete anytime

Approvals built in

Least-privilege by design — and nothing sensitive happens without your say-so.

  • Role-based, deny-by-default access
  • Sensitive actions wait for approval
  • MFA on every admin path

Every change, logged

An immutable, timestamped record of who did what and when — ready for HIPAA and SOC 2 review.

  • Tamper-evident audit log
  • Full access and change history
  • Provably handled the right way