Security

Data Encryption

• In transit: All data is encrypted using TLS 1.2+ for every connection between your browser, our servers, and third-party services.
• At rest: All data stored in our database is encrypted using AES-256 encryption, managed by Supabase on AWS infrastructure. Integration tokens (Slack bot tokens, webhook secrets) are encrypted at the application layer before storage.

Data Residency

All primary data is stored in the European Union. Our database is hosted in AWS eu-central-1 (Frankfurt, Germany) via Supabase. Our application is deployed on Vercel with EU routing (Ireland). We do not store customer data outside the EU.

Authentication & MFA

• Authentication is managed through Supabase Auth with industry-standard password hashing (bcrypt).
• Multi-factor authentication (MFA): TOTP enrolment is available from profile settings using any standard authenticator app (Google Authenticator, Authy, 1Password, etc.). Login-time enforcement for enrolled accounts is rolling out.
• Session tokens are securely managed with appropriate expiry policies. Sessions are request-scoped and never cached across requests.
• Slack and Microsoft Teams integrations use OAuth 2.0 and Bot Framework JWT verification respectively, with scoped permissions limited to only the actions required by the platform.

Access Control

• Tenant isolation: All data is scoped to your organisation. Cross-tenant reads are prevented by organisation-scoped queries at the application layer via a scoped database client. Every API route serving tenant data receives an organisation-bound client that cannot query outside the caller's organisation.
• Role-based access: Organisation members are assigned one of three roles: member, admin, or owner. Members can create and run programmes and view analytics. Admins and owners additionally manage integrations, members, and organisation settings. Billing is restricted to owners. Roles are enforced on every mutating API request.
• Audit log: Security-relevant actions (member invitations, role changes, integration connections, deletions, and billing changes) are recorded in an immutable audit log visible to organisation owners and admins.
• Internal access: Multiply platform access is restricted to named individuals via an explicit allowlist, separate from customer roles.

Infrastructure

• Application hosting: Vercel edge network with automatic DDoS protection, global CDN, and serverless compute.
• Database: Supabase managed PostgreSQL with automated backups, point-in-time recovery, and connection pooling.
• Rate limiting: API rate limiting via Upstash Redis, keyed per organisation for authenticated routes and per IP for public endpoints, to prevent abuse and ensure fair usage.

Monitoring

• Error tracking: Sentry provides real-time error monitoring and alerting across the application.
• Uptime monitoring: Betterstack monitors platform availability with automated alerting and incident escalation.
• Structured logging: Application logs are structured and retained for operational debugging and security review.

Incident Response

In the event of a security incident, we follow a structured response process:

1. Detection and containment: Automated monitoring alerts our engineering team. Affected systems are isolated immediately.
2. Assessment: We evaluate the scope and impact of the incident, including whether customer data was affected.
3. Notification: Affected customers are notified within 72 hours as required by GDPR. We provide clear details of what occurred and what actions we are taking.
4. Remediation: We resolve the root cause, implement preventive measures, and document lessons learned.

AI Data Processing

Multiply uses AI to generate Performance Journey content and behavioural analyses from your training materials.

• Training content is sent to AI providers solely for the purpose of generating behavioural analyses and Performance Journey messages.
• Content is processed in-transit and is not stored by AI providers beyond the duration of the API request.
• Your training content is not used to train or fine-tune AI models.
• All AI-generated output is presented to you for review and approval before deployment to learners and managers.
• Personal data (learner names, manager names) is not sent to AI providers. Only training content and organisational context are transmitted.

Responsible Disclosure

If you discover a security vulnerability in the Multiply platform, please report it to security@multiplytransfer.com. We ask that you give us reasonable time to investigate and address the issue before disclosing it publicly. We do not pursue legal action against good-faith security researchers.

Compliance

• GDPR: Compliant. We operate as a data processor under the GDPR and offer Data Processing Agreements on request.
• SOC 2: Not yet certified. We apply SOC 2 control principles in our engineering practices and will pursue formal certification when scale warrants it. We are transparent about this — ask us for our current control set at any time.