🔐 verybusy.io – Platform Security & Infrastructure Overview
At verybusy.io, the security and privacy of your team’s data are top priorities. Below is a comprehensive overview of the platform’s infrastructure, vendor tools, and ongoing compliance measures.
🛡️ SOC 2 Compliance
verybusy.io is committed to maintaining a strong security and compliance posture aligned with industry-recognized standards.
SOC 2 Type I
VeryBusy has successfully completed a SOC II Type I audit, which validates that our security controls were properly designed and implemented at a specific point in time in accordance with the Trust Services Criteria (Security) developed and governed by the AICPA
SOC 2 Type II (In Progress)
We are currently in an active SOC II Type II observation audit, which evaluates the ongoing operating effectiveness of these controls over an extended period. This process demonstrates our continued commitment to consistent, real-world adherence to security best practices.
Audit & Compliance Partners
Our SOC 2 program is managed in partnership with Drata and independently audited by Sensiba, a nationally recognized CPA firm specializing in security and compliance audits.
Enterprise Assurance
For enterprise customers, documentation such as an Attestation Status Confirmation and relevant SOC reports can be made available upon request, subject to standard NDA requirements.
This ongoing compliance effort supports our broader mission to provide a secure, reliable platform for managing high-value creative and production workflows.
🧱 Enterprise-Grade Account Security
We protect user access with layered authentication protocols:
All users must create a password-protected profile and verify their email before accessing any project.
Two-Factor Authentication (2FA) is available in user settings.
Single Sign-On (SSO) is supported via Google and Microsoft.
Enterprise clients can also enable SAML-based SSO with SCIM provisioning for centralized authentication and automated user management.
☁️ Cloud Infrastructure & Data Protection
verybusy.io is hosted on Amazon Web Services (AWS), leveraging its secure and scalable cloud platform. We utilize a wide range of AWS services to ensure security and operational resilience. Additionally, we integrate third-party tools like New Relic to extend observability and application performance monitoring across our stack:
🔐 Security & Compliance
AWS WAF – Web Application Firewall
AWS Shield – DDoS protection
AWS GuardDuty – Threat detection
AWS Inspector – Automated vulnerability management
AWS Secrets Manager – Credential and token storage
AWS KMS (Key Management Service) – Key control and policy management
IAM & IAM Access Analyzer – Access control and policy validation
CloudTrail – Activity logging and auditing
📊 Monitoring & Observability
CloudWatch & CloudWatch Events – Metrics, logs, and system-level monitoring
SNS (Simple Notification Service) – Real-time alerts and notifications
New Relic – Full-stack application performance monitoring and anomaly detection
🛠️ Core Infrastructure
EC2 (Instances & Other) – Compute resources
VPC – Isolated networking and routing
Elastic Load Balancing (ELB) – High-availability traffic management
ECR & ECS – Container registry and orchestration
Lambda – Event-based serverless execution
Route 53 – Global DNS resolution
CloudFront – Content delivery and caching
SES (Simple Email Service) – Email notifications
CloudShell – Secure CLI management
💾 Storage & Data Management
Amazon S3 – Secure object storage
RDS – Managed relational databases
DynamoDB – High-speed NoSQL data layer
ElastiCache – Memory caching
Glacier – Long-term archival storage
⚙️ Automation & DevOps
CloudFormation – Infrastructure as code
Service Catalog – Pre-approved deployment configurations
Kinesis Firehose – Log streaming and delivery pipelines
🌐 Third-Party Vendors
🚨 We notify all VeryBusy.io users by email whenever we add, remove, or materially change a third party vendor that processes their data.
Amazon Web Services (Cloud Infrastructure)
We use Amazon Web Services (AWS) to host core application services, including compute, storage, databases, networking, and security controls. Data is encrypted at rest and in transit. Access is restricted through IAM with least privilege and MFA, and services are deployed across AWS regions for availability and resilience.
🔗 AWS Security and Compliance Center
🔗 AWS SOC Reports via AWS Artifact
🔗 AWS Shared Responsibility Model
GitHub (Code Management)
We use GitHub as our source control and code collaboration platform. GitHub helps us manage versioning, peer reviews, CI/CD workflows, and integrates securely with our deployment pipeline.
Imgix (Image Processing and CDN)
We use Imgix as a content delivery network (CDN) for real-time image processing and secure global delivery. Their security and compliance posture is detailed here:
🔗 Imgix Security & Compliance
Intercom (User Communication)
For customer support, onboarding, and in-app messaging, we use Intercom. Intercom’s infrastructure is compliant with major standards and certifications:
🔗 Intercom Trust Center
New Relic (Performance Monitoring)
We use New Relic to monitor application performance and availability across the stack. It provides real-time observability, alerting, and error tracking to ensure a smooth user experience.
Stripe (Payments and Billing)
We use Stripe to process payments and manage subscriptions. Card data is sent directly to Stripe and never stored on VeryBusy systems. Stripe is PCI DSS Level 1 compliant. Webhooks are verified and access is restricted by least privilege.
🛡️ Network & Database Access Controls
Access to our production database is strictly limited to IPs within our VPC.
External access (including internal team members) is denied by default unless explicitly granted for maintenance or support needs.
🗂️ Content Privacy & File Management
Files are stored on Amazon S3 and served via time-limited, signed URLs.
We also use secure URLs through Imgix and other trusted infrastructure where needed.
Assets remain available until deleted by the user or workspace owner.
Trial user content is purged after 90 days of inactivity.
We never access, use, or share your content without explicit consent.
💳 Payment & Billing Security
All billing is handled through Stripe, a PCI DSS Level 1 certified provider.
Stripe uses secure tokenization and fraud prevention measures to protect all payment data.
📥 Security Questionnaires
If you are an enterprise customer and need to complete a security questionnaire, please contact your account representative.