Our Philosophy
We follow a security-first, privacy-by-design approach. Every stage of our product lifecycle, from development, to infrastructure deployment, to ongoing operations, is guided by three principles:- Confidentiality – Only the right people have access to the right data, at the right time.
- Integrity – Data remains accurate, consistent, and protected from unauthorized change.
- Availability – Systems are designed to be resilient, ensuring access when you need it.
Development Practices
- Rigorous standards: Security considerations are embedded into our coding practices, peer reviews, and testing.
- Continuous improvement: We evaluate new vulnerabilities, threats, and compliance requirements as part of our regular release cycle.
- Least privilege access: Engineers and staff only receive the minimum access necessary to perform their role.
Infrastructure Safeguards
- Defense in depth: Multiple layers of safeguards ensure that even if one control fails, others remain in place.
- Encryption everywhere: All sensitive data is encrypted in transit and at rest.
- Monitoring & detection: Traffic and access are continuously monitored to prevent, detect, and respond to potential issues.
- Resilience: Redundancy and backup strategies minimize downtime and data loss.
Where Your Data Lives
Every account has a Home Region: the United States, the European Union, or Singapore. Your account, the people on it, and every assessment response and result are stored and processed only in that region.- Independent regions: Each region runs its own application and database infrastructure. Client content is not replicated across regions, and requests for your data are served only by infrastructure in your Home Region.
- Backups stay home: Encrypted backups are kept in the same region as the data they protect.
- Sign-in: Authentication is provided by our identity provider, Stytch, a sub-processor hosted in the United States. It holds only what sign-in requires: email address, name, and, where multi-factor authentication is enabled, phone number. Assessment data is never sent to it.
- Other sub-processors: The services that help us deliver the platform, and where each one processes data, are listed in our Data Processing Agreement.
Compliance & Transparency
- Global standards: Our practices align with widely recognized privacy and security frameworks.
- Client control: Data can be exported or deleted upon request, ensuring you remain in control of your information.
- Documentation: Our Trust & Compliance Portal centralizes security policies, disaster recovery plans, and compliance resources.
- Higher education readiness: For university clients, an up-to-date HECVAT is available upon request.
Our Commitment
Security isn’t a feature we add on top — it’s a foundation we build on. By combining rigorous engineering, layered infrastructure controls, and clear client rights, Profile provides a platform that organizations can trust for the long term.For full details, see our Terms of Service, Privacy Policy, or visit our Trust & Compliance Portal.