🔐 verybusy.io – Platform Security & Infrastructure Overview
At verybusy.io, the security and privacy of your team’s data are top priorities. Below is a comprehensive overview of the platform’s infrastructure, vendor tools, and ongoing compliance measures.
📄 Compliance & Audit Status
verybusy.io is currently undergoing a SOC I Type I audit in partnership with Drata and Assurance Labs.
For enterprise clients, a letter of engagement is available upon request.
We are on track to complete the SOC I audit by end of Q2 2025, with our SOC II observation period beginning immediately after.
🧱 Enterprise-Grade Account Security
We protect user access with layered authentication protocols:
All users must create a password-protected profile and verify their email before accessing any project.
Two-Factor Authentication (2FA) is available in user settings.
Single Sign-On (SSO) is supported via Google and Microsoft.
Enterprise clients can also enable SAML-based SSO with SCIM provisioning for centralized authentication and automated user management.
☁️ Cloud Infrastructure & Data Protection
verybusy.io is hosted on Amazon Web Services (AWS), leveraging its secure and scalable cloud platform. We utilize a wide range of AWS services to ensure security and operational resilience. Additionally, we integrate third-party tools like New Relic to extend observability and application performance monitoring across our stack:
🔐 Security & Compliance
AWS WAF – Web Application Firewall
AWS Shield – DDoS protection
AWS GuardDuty – Threat detection
AWS Inspector – Automated vulnerability management
AWS Secrets Manager – Credential and token storage
AWS KMS (Key Management Service) – Key control and policy management
IAM & IAM Access Analyzer – Access control and policy validation
CloudTrail – Activity logging and auditing
📊 Monitoring & Observability
CloudWatch & CloudWatch Events – Metrics, logs, and system-level monitoring
SNS (Simple Notification Service) – Real-time alerts and notifications
New Relic – Full-stack application performance monitoring and anomaly detection
🛠️ Core Infrastructure
EC2 (Instances & Other) – Compute resources
VPC – Isolated networking and routing
Elastic Load Balancing (ELB) – High-availability traffic management
ECR & ECS – Container registry and orchestration
Lambda – Event-based serverless execution
Route 53 – Global DNS resolution
CloudFront – Content delivery and caching
SES (Simple Email Service) – Email notifications
CloudShell – Secure CLI management
💾 Storage & Data Management
Amazon S3 – Secure object storage
RDS – Managed relational databases
DynamoDB – High-speed NoSQL data layer
ElastiCache – Memory caching
Glacier – Long-term archival storage
⚙️ Automation & DevOps
CloudFormation – Infrastructure as code
Service Catalog – Pre-approved deployment configurations
Kinesis Firehose – Log streaming and delivery pipelines
🌐 Third-Party Vendors
GitHub (Code Management)
We use GitHub as our source control and code collaboration platform. GitHub helps us manage versioning, peer reviews, CI/CD workflows, and integrates securely with our deployment pipeline.
Imgix (CDN)
We use Imgix as a content delivery network (CDN) for real-time image processing and secure global delivery. Their security and compliance posture is detailed here:
🔗 Imgix Security & Compliance
Intercom (User Communication)
For customer support, onboarding, and in-app messaging, we use Intercom. Intercom’s infrastructure is compliant with major standards and certifications:
🔗 Intercom Trust Center
New Relic (Performance Monitoring)
We use New Relic to monitor application performance and availability across the stack. It provides real-time observability, alerting, and error tracking to ensure a smooth user experience.
🛡️ Network & Database Access Controls
Access to our production database is strictly limited to IPs within our VPC.
External access (including internal team members) is denied by default unless explicitly granted for maintenance or support needs.
🗂️ Content Privacy & File Management
Files are stored on Amazon S3 and served via time-limited, signed URLs.
We also use secure URLs through Imgix and other trusted infrastructure where needed.
Assets remain available until deleted by the user or workspace owner.
Trial user content is purged after 90 days of inactivity.
We never access, use, or share your content without explicit consent.
💳 Payment & Billing Security
All billing is handled through Stripe, a PCI DSS Level 1 certified provider.
Stripe uses secure tokenization and fraud prevention measures to protect all payment data.
📥 Security Questionnaires
If you are an enterprise customer and need to complete a security questionnaire, please contact your account representative.