Security
Before you point anything
at your database.
You're about to give a young company read access to the most valuable asset your agency owns. Here is exactly what happens to it, what we enforce, and what we don't have yet.
Enforced, not promised
Four things that are true today.
Each one lives in the database rather than in a policy document, which means it holds even if the application above it has a bug.
What we don't have yet
The part most security pages leave out.
Your questionnaire is going to ask. You may as well have the answers before the call rather than after it.
No ISO 27001, no SOC 2, and a date for both
We hold neither today and we will not pretend otherwise. ISO 27001 is targeted for Q1 2027 and SOC 2 Type II for Q3 2027, both on the roadmap with everything else so you can hold us to the quarter. If your procurement needs one sooner, say so early and we will tell you where we really are rather than sell you a date.
No published penetration test
No independent test has been commissioned. When one is, the summary goes on this page whatever it says.
Hosting region and sub-processors
We'll give you the current list in writing, naming every third party that touches your data and what it does. We're not publishing it here because it changes, and a stale list on a website is worse than no list.
During a trial
Nothing reaches a candidate or a client.
Outbound is switched off in the database for the whole trial, not in a setting somebody could flip by accident. No emails, no texts, no calls. You can watch the system decide it wants to send something and then watch it be refused.
That matters more than it sounds. The fastest way for a pilot to end a relationship is a message reaching a candidate that nobody approved. So the trial is deliberately incapable of it, and the block is the same one that protects a live account from a bug.
If you want proof rather than a paragraph, ask us on the call and we'll show you the refusal happening on your own account.
Who at GoodBuild can see our data?
Support access is limited and logged. If we need to look at your records to solve something, we ask first. Tell us on the call if you want that arrangement in writing and we'll put it in the contract.
What happens to our data if we leave?
Your CRM was never emptied, so it's already whole. Anything held on our side is deleted on request after the account closes, and we'll confirm in writing when it's done.
Is candidate data used to train a model?
Your records are used to do your work. If you want that stated as a contractual term rather than a sentence on a website, ask and it goes in the contract.
Can we run a security review before signing?
Yes, and we would rather you did. Email build@goodbuild.io with your questionnaire and we'll complete it, including the questions where the answer is no.
Send us the hard questions.
We would rather lose a deal on an honest no than win one on a badge we don't hold.