notice

Attio Trust Center

2,807 words, 61 clausesno date on the pageread 23/10/2026source

·Attio

·Security and Compliance represent key aspects of any product your team uses. Attio is committed to securing access to your data, eliminating systems vulnerabilities and ensuring continuity of access.

·Attio uses an array of industry-technologies and services to protect your data against unauthorized access, disclosure, use, and loss. security@attio.com Privacy PolicyOpens in new tab

·Controls

·Infrastructure security

Control
Encryption in Transit All network communication between production systems is encrypted in transit. Transport Layer Security (TLS) version 1.2 or 1.3 is implemented for all production network traffic, including internal service-to-service communications, external interfaces and administrative access channels. Unencrypted or insecure protocols are not used for transmitting production data.
Status Page Attio maintains a public status page at https://status.attio.comOpens in new tab. The status page is updated within 30 minutes of the incident response team becoming aware of a customer impacting issue. A documented process is maintained for publishing updates to the status page. The VP of Engineering is responsible for maintaining this process. The process is updated anually or when changes are made to the organisation that result in changes being needed. Records of all incidents published to the status page are retained for at least 90 days.
Web Application Firewall Attio maintains a Web Application Firewall (WAF) to protect all ingress traffic on production networks. The WAF is configured to detect and block malicious traffic and malware delivery attempts. The WAF is configured with rate limiting and DDoS protection rules to allow mitigation of volumetric attacks. The SIP Team Lead is responsible for regularly reviewing WAF rules, monitoring alerts, and ensuring that the WAF remains effective against evolving threats. WAF configurations and effectiveness are reviewed at least annually, upon changes to the application or threat landscape that result in changes to the WAF configuration, with documented evidence retained for audit purposes.
Network Segregation Attio maintains segregated networks for all production workloads to enforce strict separation of environments and safeguard customer data. The network segregation configuration is reviewed at least annually, or upon changes to the environment that would result in changes to the network segregation configuration, to ensure ongoing protection of customer data and compliance with access management requirements. Documented evidence of network segregation and access controls is retained for audit and assurance purposes.
Automated monitoring Attio maintains automated monitoring systems to continuously detect and alert on platform availability issues. Monitoring configurations and alert thresholds are reviewed at least annually, or upon changes to the platform architecture that required changes to the conffigurations and alert thresholds, to ensure effective detection and timely response to availability incidents. Records of monitoring activities and incident responses are retained for audit and analysis.
Security Monitoring All critical systems are configured to generate alerts for predefined security events. Each alert is triaged by the SIP Team and the Incident Response Process it activated upon verification of the suspected security event.
Production system security All production systems are hosted within securely managed data centers operated by approved Cloud Platform vendors. The SIP Team Lead is responsible for reviewing and verifying vendor datacenter security controls at onboarding and at least annually thereafter. Documented evidence of these reviews and vendor compliance is retained for audit and assurance purposes.
Audit Logging Cloud Infrastructure services used to process Customer Data are configured to retain audit logs of all administrator actions. Logs are subject to the organization's standard log retention policies.
Log Management Logs from production systems are stored centrally in a designated location. Logs are stored in a way that prevents them from being destroyed or modified after ingestion. All production system logs are retained for 90 days. All control plane audit logs are retained for 400 days.
Key Management System All root encryption keys (both symmetric and asymmetric) used to encrypt customer data are stored in the Google Cloud Key Management System. 1 to 10 of 17 results

·Organizational security

Control
Information Security Roles and Responsibilities Roles and responsibilities for Information Security operations are documented and communicated to relevant personnel. Specific accountability is assigned for information security management systems, risk ownership, compliance reporting and audits. The document is reviewed annually or upon significant changes to the organization or its ISMS. The document is owned by the Customer Trust program manager and approved by the CTO.
Internal Audits Attio performs internal audits of all of its information security controls on an annual basis. The audit is conducted by a qualified employee or contractor. The Customer Trust program manager is responsible for the organisation of the audit within twelve months of the completion of the previous audit. An internal audit report is produced by the auditor which documents what has been tested, any non-conformities or areas of improvement, as well as a summary of the methodology used to conduct the audit. Internal audit reports are presented to the CTO and are retained as documented information.
External Audits for ISO 27001 Attio performs external certification audits of its Information Security Management System against ISO 27001 on an annual basis. The Customer Trust program manager is responsible for arranging the audit to ensure the organization maintains its external ISO 27001 accreditation at all times.
Management Reviews Management Reviews are performed annually to review the Attio's Information Security Management System's suitability, adequacy and effectiveness. The review considers audit results, risk status, incident trends, objectives, compliance obligations and opportunities for improvement. The review results in documented decisions and actions necessary to maintain and improve the organization's ISMS. The Management Review is maintained as documented information. The Customer Trust program manager is responsible for owning the Management Review process and the results are approved by the CTO. The Management Review is communicated to the CEO and to Attio's Board of Directors.
Document Management Attio maintains a documented procedure to control documented information required by its Information Security Management System alongside other information determined by the organization as necessary for the effective operation of its ISMS processes). The procedure includes how documented information should be created, updated, labelled, protected, retained and destroyed. The procedure is reviewed annually, or upon significant changes to the organisation.
Information Security Policy A documented Information Security Policy is maintained, made available and signed by all employees and contractors. The policy defines Attio's commitment to information security, its information security objectives, and the continual improvement of its information security program. The policy is maintained by the SIP team lead and approved by the CTO.
Information Security Objectives and Standards Information security objectives and standards are established for the organisation and maintained as documented information. Objectives are measurable and aligned with the organization's strategic goals. Objectives are reviewed annually, or upon major changes to the organisation. Objectives are owned by the CTO and approved by the CEO.
Information Security Metrics Information Security Metrics are established to measure ISMS performance and effectiveness of its controls. Results are analysed by the Customer Trust program manager on a quarterly basis. Documented evidence of the outcomes of this review are maintained as documented information.
Risk Management Policy Attio maintains a documented Information Security Risk Management Policy that defines a formal framework for the identification and management of Risk. The policy defines the risk assessment methodology, roles and responsibilities, frequency, criteria and reporting requirements. The policy is maintained by the Customer Trust program manager and approved by the CTO. The policy is distributed to all members of the Information Security team. The policy is reviewed at least annually, and upon changes that result in changes to the policy
Risk Register Attio maintains a centralised Risk Register as an authoritative record of identified risks, assessment results, treatment plans and acceptance decisions. Snapshots of the risk register will be retained as documented evidence upon revisions or changes. 1 to 10 of 12 results

·Product security

Control
Static Application Security Testing Automated Static Application Security Testing (SAST) rules are maintained and all code changes are required to pass SAST tests prior to being integrated into the main branch and deployed to production.
Dynamic Application Security Testing Automated Dynamic Application Security Testing (DAST) scans are performed against production systems on a regular basis. The SIP Team Lead is responsible for configuring the scan schedule, reviewing scan results, and tracking remediation of DAST scan findings.
Penetration Testing Attio undertakes annual penetration tests conducted by an external firm. The SIP Team Lead is responsible for planning, organising and support the execution of the penetration test. The penetration test is undertaken by a qualified and reputable external penetration testing firm. Penetration tests are conducted within at most twelve months of the completion of the previous penetration test. Penetration tests reports are presented to the CTO for review. All identified vulnerabilities are tracked in Linear and resolved in line with the organization's defined SLAs. Redacted penetration test reports are made available to customers, subject to approval by the CTO.
Secure Coding Principles Attio maintains documented Secure Coding Principles, which are reviewed annually and approved by the CTO. All employees and contractors with the ability to modify source code are required to attend Secure Coding training at least once every six months. The SIP Team Lead is responsible for ensuring that training is provided and that a record of attendance is maintained.
Code Review All code changes are subject to a code review by a different engineer to the author of the change. Automated controls are maintained to prevent the integration of unreviewed code into the application. In incident scenarios where urgent remediation is required, code changes may be deployed without prior review. A post-implementation review is conducted as soon as possible after deployment.
Automated Testing An automated test suite is maintained and all code changes are required to pass automated testing prior to being integrated into the main branch and deployed to production.
Deployment Restrictions Automated controls are maintained to prevent employees and contractor from directly modifying code in production environments. All code deployments happen through an approved and documented CI/CD flow.
Infrastructure as Code Infrastructure is configured and deployed using an Infrastructure as Code system which is subject to the same controls as other source code modifications. Changes to the system that involve the manual provisioning or modification of infrastructure are accompanied by a Memo in Notion which considers the security and availability implications of the change. All manual changes to production systems are accompanied by a Linear ticket which describes the purpose of the change.
Version Control Attio uses GitHub to maintain a secure, hosted repository for its source code. The Git version control system is used to track changes made to the system and to archive previous versions of the code base.
Open Source Dependency Inventory An inventory of all Open Source Dependencies is maintained. The inventory is updated as dependencies are changed, reviewed quarterly for accuracy and approved by the CTO. 1 to 10 of 14 results

·Internal security procedures

Control
Incident Response Process A documented Incident Response Process is maintained by the SIP Team Lead. This documentation includes a clear definition of the roles and responsibilities for the detection, reporting, escalation and response to security incidents. The process is owned by the SIP team lead, approved by the CTO, and published to all personnel. The process is reviewed and tested annually, upon significant changes to the organisation, or in response to incident root cause analysis.
On-Call Schedule Attio maintains a 24/7/365 on-call engineering rota. At least one engineer is available with a 30 minute response time at any time. The CTO is responsible for the operation of the on-call rota and documented logs of the on-call rota are retained for 12 months.
Root Cause Analysis Post Mortems are conducted for all incidents that are a P1 or above severity. The Incident Lead for each incident is responsible for scheduling post mortems within 7 days of the incident response process concluding. Documented records are retained from each post mortem meeting which includes a Root Cause Analysis (RCA) and lessons learned process. Lessons learned action logs are kept and actioned.
Runbooks (Documented Operating Procedures) Attio maintains documented runbooks for configured alerts relating to platform availability and data security. Runbooks are maintained in Notion and reviewed annually.
Privileged Access Management Attio does not grant permanent access to Cloud Infrastructure projects used to process Customer Data. Individuals are required to use temporary and time limited access requests in order to access Cloud Infrastructure. A documented process is maintained for employees and contractors to obtain access to Cloud Infrastructure providers.
Service Account Management An inventory of all Service Accounts and API Keys, used by automated systems to access resources, is maintained. The inventory contains the scope of access granted to each Service Account and API Key to ensure that access is granted based on the principle of least privilege. Service Accounts are reviewed quarterly and a documented log of each review is maintained. The SIP Team Lead is responsible for maintaining the inventory and reviewing service account access.
Secrets Management An inventory of all Cloud Infrastructure credentials and sensitive configuration items ("secrets") is maintained. Each secret is assigned a rotation schedule, with the rotation procedure documented for each secret. All secrets are stored in a secure secrets management storage. All source code is scanned daily for presence of secrets. The SIP Team Lead is responsible for maintaining the secrets inventory and monitoring the secrets rotation on a quarterly basis.
Access Review Process Access Reviews are performed for all systems and documented evidence of each access review is maintained. Access Reviews verify that users have only the necessary access rights to systems. Access Reviews are performed quarterly for critical systems, and annually for all systems. Access that is determined to be no longer requires is revoked within 7 days. The IT Manager is responsible for performing Access Reviews and maintaining documented records of their completion.

·Data and privacy

Control
Privacy Policy A Privacy Policy is maintained and made publically accessible to data subjects through Attio's website. The policy provides information on how personal data is collected, processed and stored, as well as the rights of the data subject under GDPR. The policy is maintained by the Legal team and approved annually by the Director of Legal.
Data Protection Agreements (DPAs) with Suppliers Data Protection Agreements (DPAs) are in place with all suppliers who process personal data on Attio's behalf. These agreements ensure that suppliers meet the necessary data protection standards and comply with GDPR requirements.
Subprocessor List A comprehensive list of subprocessors that are involved in the processing of personal data belonging to our customers is maintained. The list is updated as part of onboarding a new subprocessor and a documented notification process exists to inform customers of the update. This list is made available to customers as required by GDPR.
EU Representatives Attio appoints an EU Representative in accordance with Article 27 of GDPR for data processing activities that are subject to GDPR.
Information Classification Attio maintains a documented Data Management Policy that defines a formal framework for classifying, labelling, storing and destroying information assets. The policy includes the definition of classification levels for both customer and internal data as well as corresponding labelling, storage and handling requirements. The policy is owned by the SIP team lead, approved by the CTO, and published to all users. It is reviewed at least annually, and upon change, that result in the need to change the data amanagement policy. All employees and contractors accept the latest version of the policy within one month of commencing employment and within one month of a new version of the policy being published.
Data Inventories Data Inventories are maintained for the organisation's virtual Information Assets. A seperate data inventory is maintained for Customer Data and internal information. The Data Inventory includes information about the type of information stored, the Information Classification of the asset and the geographic location where it is stored. Data inventories are updated as needed, reviewed annually and approved by the CTO.
Data Destruction Attio mantains a Customer Data Destruction Policy, which details the process for the thorough and automatic destruction of customer data upon account termination. This process is audited to ensure the data destruction process is functioning to the standard of which the policy requires.
Insurance maintained Attio maintains insurance sufficient to cover its contractual obligations to its customers. The Director of Operations and Legal are responsible for ensuring that all necessary insurance is in place. Insurance providers and policies are reviewed annually by the Director of Operations and approved by the Director of Legal
Relevant Legal, Regulatory and Contractual Requirements Attio maintains a documented record of Relevant Laws, Regulations and Contractual Requirements that identifies all applicable legal, statutory, regulatory and contractual obligations related to information security and data protection. The document is maintained by the Legal team. The document is reviewed annually or upon significant changes to the organization or upon significant changes to the external landscape (such as regulation or significant contracts). Top