Security
Built multi-tenant from day one – every workspace isolated, every role enforced on the server, every infrastructure provider SOC 2 audited. Your data is protected by the same infrastructure that powers the world's leading software companies.
Compliance program
The AI CMO is built and operated by ROGA AI LIMITED: GDPR compliant, with SOC 2 Type II controls in place, monitored with Comp AI, and the audit underway. Policies, monitored controls, framework status and the security questionnaire are published live in the ROGA Trust Center, so procurement and security teams read the same record the auditor does.
Open the ROGA Trust CenterHow we protect your data
AES-256 encryption at rest, TLS 1.2+ in transit. All data encrypted end-to-end.
Multi-factor authentication (TOTP), OAuth sign-in, and short-lived JWT sessions. Our own admin surfaces require MFA – and the check fails closed, never open.
Row-Level Security on every table. Each workspace's data is scoped to its organization, and each brand's data to its profile – in the product and in the data warehouse alike.
Owner, admin, manager, and member roles are checked on the server for every operation – billing, data sources, configuration. A hidden button is never the security boundary.
Platform connections run through SOC 2 OAuth brokers – for proxied connections, tokens are injected server-side and your passwords never pass through us. Card data never touches our servers (Stripe, PCI DSS Level 1).
Webhook ingestion authenticates every request with a per-source secret key, and repeated events never double-count. Your imports stay yours: every batch is listable and deletable, and full account deletion is a request away.
Infrastructure
We build on enterprise-grade infrastructure from providers that maintain the highest security certifications.
GDPR
Our security questionnaire, policies and live control status are published in our Trust Center.