---
title: "Security"
description: "SOC 2 Type II, ISO 27001, ISO 27701, GDPR: the certifications, the controls behind them, and how to get the reports."
canonical: https://past.dev/security
last-updated: 2026-08-26
---
# Security

Source: https://past.dev/security

past.dev is SOC 2 Type II audited, ISO 27001 and ISO 27701 certified, and GDPR compliant. The controls are audited every year, and the reports are one email away.

## Certifications

- SOC 2 Type II: Independently audited controls tested over a period of time, not at a point in time. The evidence is that the controls operated, not that they were described.
- ISO/IEC 27001: Information security management, independently certified. Access control, cryptography, secure development, supplier management, logging and incident response are audited controls, not habits.
- ISO/IEC 27701: Privacy information management, extending 27001. How personal data is processed, minimised, retained and handled when someone exercises their rights.
- GDPR: A legal regime, not a certificate. ISO 27701 is how we manage it: minimisation, retention and data subject rights are controlled, audited processes.

## How the API handles your data

- Encrypted everywhere. TLS in transit, AES-256 at rest. Credentials stored for your own integrations are encrypted at rest too.
- Evidence is the product. Ingested content is stored so answers can cite it. Delete any ingestion with DELETE /api/v1/ingest/{id}, or ask us to erase a project.
- Projects are isolated. A key is scoped to one project and cannot read another. On the MCP server the workspace is derived server-side, never a request parameter.
- Never trains models. Your data never trains models. Model providers process requests with zero retention.
- No casual access. Production access is restricted to the people who operate the service, logged, and inside the audit scope.

## Identity and access

- Keys you can kill. The Memory API uses project-scoped keys, sent as a bearer header. Revoke a key at any time.
- No standing credentials on MCP. Sign-in is OAuth 2.1 with PKCE. Tokens are short-lived and bound by audience to the MCP endpoint, and every request re-derives permissions from the database. Anything unknown fails closed.
- Your SSO applies. Workspaces with SAML or OIDC single sign-on authenticate through their own IdP, so MFA and conditional access carry over to past.dev unchanged.

## Operations

- AWS, encrypted backups. The platform runs on AWS. Backups are encrypted.
- Monitored continuously. Monitoring and alerting run around the clock, and compliance is monitored continuously in Vanta.
- Tested by outsiders. An independent third party runs penetration tests annually. Findings are tracked to closure inside the audited process.
- 15-minute notification. Affected customers are notified within 15 minutes of a confirmed security event.

## Frequently asked questions

### Is past.dev SOC 2 Type II compliant?

Yes. Controls are tested over a period of time by an independent auditor, not at a point in time. The report is available under NDA in the compliance pack.

### Is past.dev ISO 27001 certified?

Yes. The information security management system is independently certified.

### Is past.dev ISO 27701 certified?

Yes. ISO 27701 extends 27001 to privacy information management: how personal data is processed, minimised, retained and handled when someone exercises their rights.

### Is past.dev GDPR compliant?

Yes. A data processing agreement and the current subprocessor list are available on request, and data subject requests are handled within the statutory windows.

### Does my data train AI models?

No. Your data never trains models, and model providers process requests with zero retention.

### How is data deleted?

By ingestion id with DELETE /api/v1/ingest/{id}, immediately. Project and account-level erasure is one request away. Deletion is not a ticket queue.

### Where does past.dev run?

On AWS, with encrypted backups. The current subprocessor list ships with the compliance pack.

### Do you run penetration tests?

Yes, an independent third party tests annually, and findings are tracked to closure inside the audited process.

### How do I get the SOC 2 report or a DPA?

Book a call or write to support@past.dev and we send the current compliance pack: the SOC 2 report, certificates, audit periods and the subprocessor list. Those details change each audit cycle, so they live in the pack, not on this page.

### How do I report a vulnerability?

Write to support@past.dev. Disclosure mail is read first.

Compliance pack and DPA: https://cal.com/team/revo/30min or support@past.dev.