Security
One Horizon runs on EU infrastructure, inherits the access rules of the systems you connect, and encrypts data in transit and at rest. This page describes the controls we can evidence today, so your security team can review them before rollout.
Certification
One Horizon does not hold a SOC 2 report today. We build our controls against the SOC 2 criteria, and we will say so here when a report exists.
Pilot-first rollouts are available for teams that want a narrow, auditable scope before broader adoption. Contact us for a security overview and data handling details.
Data Residency
One Horizon is EU-first. Our application hosting and primary data storage run in the EU: Fly.io in Amsterdam and Supabase in eu-central-1.
Some suppliers process data outside the EU. Those are the exceptions, they are named with their locations in the subprocessors table, and transfers to them rely on an adequacy decision or standard contractual clauses.
Services you connect yourself, such as GitHub, Slack, Jira, Linear, coding agents, and MCP servers, process data under their own terms and may do so outside the EU. You decide which ones to connect.
Encryption
At Rest: Our hosting providers encrypt stored data at the disk and database layer. Sensitive values such as integration access tokens are additionally encrypted by us before they are stored.
In Transit: Traffic between your browser, our services, and the integrations you connect runs over TLS.
Token Security
You sign in through an identity provider rather than a One Horizon password. We never receive or store your password at Google, GitHub, Apple, or Slack, and we cannot reset it.
Access tokens are encrypted using authenticated encryption. This provides both encryption and cryptographic signing to prevent tampering.
Encryption keys are stored separately from the encrypted data and are never stored in the database itself.
Access Controls
We inherit your existing permissions from connected services. When you connect integrations, we respect all user-level access controls from your source systems.
If you don't have access to a repository in GitHub or a channel in Slack, we don't have access either.
Compliance
GDPR: The data processing agreement in our Terms of Use applies to self-service customers without a separate signature. We honour data subject rights, including deletion and portability, as described in the Privacy Policy.
Incident response: We have procedures for detecting and responding to security incidents. Where a personal data breach affects data we process for you, we notify you without undue delay after we become aware of it, and follow up with details as the investigation develops.
Infrastructure Security
Our infrastructure uses network isolation and automated security patching. We use Cloudflare to help prevent DDoS attacks and filter malicious traffic before it reaches our servers.
Database access is restricted through encrypted connections and role-based permissions.
Transparency
If you have specific security questions or need additional documentation for your organization's security review, contact our legal team.