Trust and Compliance
Built to pass your security review.
SOC 2 Type 2 audited, GDPR and HIPAA ready, and CASA Tier 2 verified for Google Workspace. Your data is never used to train AI models. Request our SOC 2 report any time.
SOC 2, Type 2
Fully compliant. Audited annually by Armanino. Report available upon request.
GDPR
Coffee processes and protects EU personal data in accordance with the General Data Protection Regulation (GDPR).
HIPAA
Call recordings and emails can contain patient information. We sign BAAs with healthcare and health-tech customers and apply HIPAA safeguards to that data.
CASA for Google Apps
Certified to Tier 2 Cloud Application Security Assessment standards for enterprise-grade security.
No training
Your data is never used to train AI models, ours or anyone else's. When you query Coffee from Claude or ChatGPT, the provider keeps nothing under our zero-data-retention terms, and users see only the records they can already see in Coffee.
Policies
Every employee passes a background check and completes security training at hire and annually. Access to customer data is least-privilege, needs approval, is logged, and is reviewed quarterly.
Process
Every code change is peer-reviewed and scanned before release. An independent firm pen-tests the platform annually.
Infrastructure
Data is encrypted with AES-256 at rest and TLS 1.2+ in transit. We connect to your tools through OAuth, so we never see or store your passwords, and you can revoke access from your own admin console at any time.