This is the public record of how GrowBig IT protects client systems and data. It covers our compliance posture, security controls, availability commitments, data processing terms, subprocessors, and vulnerability disclosure process.
Current posture
All systems operationalApplication availability
99.98% rolling 90-day average
Uptime monitoring
External checks every 60 seconds
Backup jobs
Daily encrypted snapshots
Vulnerability scanning
Dependency and container scans
Incident response
On-call rotation with 1-hour P1 target
Last reviewed October 2026
Compliance
Certification scope is confirmed per engagement. Reports and evidence are shared under NDA with prospective clients and auditors.
SOC 2 Type II
Our control environment is audited annually against the SOC 2 Trust Services Criteria. The report covers access management, change management, monitoring, incident response, and vendor oversight.
GDPR & DPA
A data processing agreement covering purpose, retention, subprocessors, transfers, and deletion is available on request. We support client security questionnaires and vendor reviews.
Security Controls
These controls apply to our internal environment and to client systems we operate, with scope documented in each engagement.
Least-privilege roles, mandatory MFA, SSO where available, and quarterly access reviews. Production credentials live in a managed secret store, never in source control.
TLS 1.2+ in transit and AES-256 at rest for managed data stores. Backups are encrypted with separately managed keys and tested on a defined schedule.
Centralized audit logs, error tracking, uptime probes, and alert routing. Client environments can ship logs to their own SIEM under the engagement agreement.
Typed interfaces, dependency review, secret scanning, and automated checks in CI. Infrastructure is defined as code and deployed through controlled pipelines.
Background checks where lawful, confidentiality agreements, security onboarding, and role-based training for every engineer with production access.
Documented severity levels, named incident owners, client notification for confirmed material impact, and a written post-incident review.
Uptime & SLA
Production systems are monitored from outside our infrastructure every 60 seconds. Incidents are classified by severity, with response targets written into the engagement agreement.
Rolling 90-day availability
99.98%
Credit-backed SLA for contracted production environments. Measurement excludes scheduled maintenance announced at least 72 hours in advance.
| Month | Uptime | Incidents | Avg. detection |
|---|---|---|---|
| September 2026 | 99.99% | 0 | 42 sec |
| August 2026 | 99.98% | 1 minor | 58 sec |
| July 2026 | 100.00% | 0 | 39 sec |
| June 2026 | 99.98% | 1 minor | 61 sec |
| May 2026 | 99.97% | 1 minor | 54 sec |
| April 2026 | 100.00% | 0 | 44 sec |
P1
Production down or data at risk
1 hour
Every 60 minutes
P2
Major feature degraded
4 hours
Every 4 hours
P3
Minor issue or question
Next business day
Daily
Data Processing
We process the minimum data required to deliver and support the engagement. The DPA defines purpose, scope, retention, and the security measures attached to that processing.
Data handling defaults
Subprocessors
The final list for an engagement is documented in the DPA. Material changes receive 30 days notice and a right to object.
| Provider | Purpose | Data category | Location |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, storage, and backups | Application data, logs, backups | United States / EU |
| Vercel | Application delivery and edge hosting | Request metadata, application logs | Global edge / United States |
| Cloudflare | CDN, DNS, and web application firewall | Request metadata, security logs | Global edge |
| Stripe | Payment processing | Billing contact, payment metadata | United States / EU |
| GitHub | Source control and CI runners | Source code, build metadata | United States |
| Google Workspace | Email, documents, and collaboration | Contact details, project documents | United States / EU |
| Sentry | Error tracking and performance monitoring | Error traces, request metadata | United States |
Last updated October 2026 · scroll horizontally on smaller screens
Security Disclosures
If you believe you have found a vulnerability in a GrowBig IT system, contact us privately. We will acknowledge the report, investigate, and coordinate disclosure. We do not pursue legal action against good-faith researchers who follow this policy.
24h
Acknowledgement target
72h
Initial triage
90d
Coordinated disclosure
Report a vulnerability
security@growbigit.comInclude the affected system, reproduction steps, and potential impact. Encrypt sensitive details if possible and avoid accessing data that is not yours.
Do not run destructive tests or denial-of-service attacks.
Do not access, modify, or exfiltrate customer data.
Give us reasonable time to remediate before disclosure.
