Security your IT team can sign off on
Bettermode is SOC 2 Type II compliant and built for GDPR and CCPA. We encrypt member data at rest and in transit and host it in the US or Germany. Your admins decide who gets in.
Bettermode security at a glance
The facts security and procurement teams ask for first.
- ComplianceBettermode is SOC 2 Type II, GDPR and CCPA compliant on every plan. Premium customers can get the SOC 2 report, and the data processing agreement also covers UK GDPR and PIPEDA.
- Hosting and data residencyBettermode runs on Amazon Web Services. Each customer chooses whether its community’s data is stored in the United States or in Germany.
- EncryptionBettermode encrypts member data with 256-bit encryption at rest and in transit, and every custom domain is served over SSL.
- Sign-inMembers can use social login on every plan, and OAuth2 or JWT single sign-on on Growth and Premium. Admins and moderators can use SAML on Premium.
- Admin controlsAdmins set password strength, roles, private spaces, custom security headers and which sites may embed the community. Premium adds a 90-day audit log.
- Status and uptimeLive platform status and incident history are public at status.bettermode.com. Premium includes a 99.9% uptime SLA.
Security documents for your vendor review
The legal documents are public and linked below. Premium customers can also get the SOC 2 Type II report from Sales.
How Bettermode protects member data
It starts in the infrastructure, well before anyone signs in.
Encryption
Member data is protected with 256-bit encryption at rest and in transit.
Data residency
Store your community’s data in the United States or in Germany for the EU. It’s on every plan.
Hosted on AWS
Bettermode runs on Amazon Web Services, in data centers certified to SOC 2 and ISO 27001.
Least-privilege access
Our staff get only the access their job needs. We review it every quarter and remove it within 24 hours of someone leaving.
Network security
Access control lists block unauthorized requests, and a SIEM system flags suspicious activity.
Separate environments
Production and testing are kept apart. Growth and Premium also get a sandbox for trying changes.
Security controls your admins own
Decide who signs in and how, what each role can do and which sites can embed your community. The audit log shows what changed and who changed it.
Single sign-on
Members sign in through your identity provider with OAuth2 or JWT on Growth and Premium, and admins and moderators can use SAML on Premium. Google, LinkedIn and Slack login work on every plan.
Password strength
Set how strong member passwords need to be.
Security headers and SSL
Add custom security headers to harden the browser against common attacks. Custom domains are served over SSL.
Roles and private spaces
Admins, moderators, space admins and members each have their own permissions. Make the whole site or any space private or hidden.
Embedding control
Let the community be embedded only on domains you list, which protects members from clickjacking.
Audit log
Premium keeps 90 days of admin and member activity, so you can see who changed what and when.
Security features on each Bettermode plan
Every plan gets the essentials. Premium adds the controls larger teams ask for.
Plans as listed on bettermode.com/pricing.
How Bettermode builds and runs the platform
These practices apply to our staff, our service providers and the data centers we run in.
Automated security scans
Changes are scanned for vulnerabilities, and critical fixes go out first.
Reviewed releases
Nothing reaches production without going through QA.
External penetration tests
On top of our own scans, outside specialists test the platform regularly.
Vetted, trained staff
Employees pass background checks under local law, complete security training every year and work on encrypted laptops.
Privacy tools for your community
A built-in policy and guidelines tool for your GDPR and CCPA pages, a cookie consent manager, and OneTrust or Usercentrics on Growth and Premium.
Public status page
Live status for North America and Europe, with incident history, at status.bettermode.com.
Questions security teams ask
Running a security review?
Talk to Sales and we’ll walk your team through how Bettermode handles your data.
