DRAFT – not in effect until the owner sets version 1.0 and an effective date.
Security Disclosure
1. Purpose & Scope
This document summarizes DataChimp Labs’ security posture for prospects and customers. It is a plain-language public summary intended to support vendor due diligence and procurement review.
The authoritative source of record for DataChimp Labs’ security
program is the internal information-security-policy.md. In the
event of a conflict, the internal policy controls.
2. Encryption at Rest
DataChimp Labs encrypts customer data at rest using AWS Key Management
Service (“AWS KMS”) – managed keys and industry-standard AES-256
encryption. Per-tenant customer master keys (“CMKs”) are used where
tenant isolation is contractually required. Full details are in
encryption-at-rest-policy.md.
3. Encryption in Transit
DataChimp Labs encrypts data in transit using TLS 1.2 as a minimum
and TLS 1.3 where supported by client software. Certificates are
provisioned and rotated through AWS Certificate Manager (“ACM”).
Cipher suites are restricted to those recommended by current NIST
guidance. Full details are in encryption-in-transit-policy.md.
4. Tenant Isolation
DataChimp Labs operates a multi-tenant architecture with logical isolation between tenants. Enterprise tenants receive a per-tenant sub-account model with dedicated IAM boundaries. Cross-tenant access is prevented at the application, database, and infrastructure layers, and cross-tenant queries are structurally impossible in the composite table design.
5. Access Control
DataChimp Labs enforces role-based access control (“RBAC”) with the
principle of least privilege. Multi-factor authentication (“MFA”) is
required for all privileged access to production systems. Access is
reviewed on a documented cadence and revoked on personnel change.
Full details are in access-control-policy.md and
authentication-mfa-policy.md.
6. Audit Trail
DataChimp Labs maintains a comprehensive audit trail across the
infrastructure and application layers. AWS CloudTrail captures API
activity across production accounts; application-level audit logs
capture authentication events, privileged actions, and data access.
Log retention follows data-retention-and-disposal-policy.md.
7. Incident Response
DataChimp Labs operates a documented incident response process with
severity classification, on-call rotation, and defined escalation
paths. Customer notification of incidents affecting customer data is
provided in accordance with the applicable Business Associate
Agreement (business-associate-agreement-template.md), Data
Processing Addendum (data-processing-addendum.md), or Terms of
Service (terms-of-service.md). See information-security-policy.md
for the internal process.
8. Vulnerability Management
DataChimp Labs operates a documented vulnerability management program
covering dependency scanning, infrastructure scanning, and periodic
penetration testing. Security researchers may report suspected
vulnerabilities via in accordance
with our vulnerability disclosure program. Full details are in
vulnerability-management-policy.md.
9. Compliance Posture
DataChimp Labs’ security program is:
- SOC 2-aligned – designed and operated in accordance with the AICPA Trust Services Criteria for security, availability, and confidentiality.
- HIPAA-aligned – administrative, physical, and technical safeguards implemented in accordance with 45 CFR Part 164, Subparts A and C, for engagements involving Protected Health Information.
- GDPR-informed – processing of Personal Data on behalf of
customers is governed by the
data-processing-addendum.md. - CCPA-informed – processing of personal information subject to
the CCPA/CPRA is addressed in the
privacy-policy.mdand the DPA.
DataChimp Labs does not currently publish a SOC 2 Type 2 report or a HIPAA audit attestation. When one becomes available, this section will be updated to reference it and the report will be made available under a mutual non-disclosure agreement upon request.
10. Vendor Due Diligence
DataChimp Labs supports vendor due diligence and procurement review. Requests for security questionnaires (including SIG-Lite, CAIQ, or custom questionnaires) should be sent to . A standard SIG-Lite response is available on request.
11. Contact
Security inquiries and vulnerability reports: