Compliance

BugMojo is pursuing a SOC 2 Type I report, working with a SOC 2 compliance-automation vendor for evidence collection and continuous control monitoring. The report is expected later this year.

To be clear about status: we are not yet SOC 2 certified. The initial scope covers the Security (Common Criteria) trust services criteria. The two controls we are furthest along on (audit logging and access controls) are already implemented in the product (see the Security page). If your procurement process needs to see our kickoff plan or a bridge letter timeline, contact us and we’ll share what we can.

We support the core data-subject rights in the product today:

• Data export. Users can export their personal data.
• Erasure. Users can delete their account and associated data, and workspace admins can erase feedback submitted by a given email or device fingerprint.
• Consent records. The extension requires explicit consent before it records anything, and stores the time and version of that consent on the device.
• Data minimization. Network bodies are never captured and redaction runs before upload; see Security.

A Data Processing Addendum is available; see /dpa for the template and a path to request a signed copy.

Capture artifacts (replays, logs, screenshots, video and voice notes) are stored in AWS S3 in India (Mumbai, ap-south-1). The database (Neon PostgreSQL) is in Singapore (ap-southeast-1), and the app servers run on Vercel in the United States. EU data residency is on the roadmap; it is planned, not yet available. For transfers out of the EEA, the UK and Switzerland, our DPA references Standard Contractual Clauses; contact us if data-residency requirements are a gating factor for your deployment. The full list is on our subprocessors page.

Role-based access control, revocable API keys (read-only by default), revocable MCP OAuth grants, and a company-scoped audit log of admin and configuration changes (on every plan) are implemented today. These map directly to the SOC 2 access-control and audit-logging criteria. Details are on the Security page. SSO / SAML is coming to the Team and Enterprise plans and is not yet available.

• Security overview: data handling, redaction, encryption, access control.
• SDK performance & overhead: bundle sizes and runtime behavior.
• Data Processing Addendum: template and signed-copy request.
• Subprocessors: the third parties we use to run the service.
• Vulnerability Disclosure Policy: safe harbor, scope, response times.
• Privacy Policy

Need us to complete a vendor security questionnaire (SIG-lite or your own template)? Email contact@bugmojo.com and we’ll turn it around. We maintain a set of canned answers to the most common questions so most reviews move quickly.