Security

Boring on purpose.

Gatsby teams work inside client environments, on systems that run real operations. That only works if the security posture is audited, documented, and independently attested, so it is.

SOC 2

Gatsby holds a SOC 2 attestation issued under the AICPA's attestation standards, covering our security controls: how we manage access, devices, vendors, and change, and how we respond when something goes wrong.

The full report is available to clients and prospects under NDA. Email us and we'll send it over.

HIPAA

For engagements that touch protected health information, Gatsby operates under HIPAA. We sign business associate agreements, and PHI is handled under controls aligned to the Security and Privacy Rules: minimum necessary access, encryption in transit and at rest, and defined breach notification procedures.

How we work

Embedded, not extractive.

Your stack, your controls

Our builders work inside your environment, under your identity provider and your access policies. Client data stays in client systems; we do not copy it out to ours to work on it.

Least privilege, always

Access is scoped to the engagement: the repos, systems, and data the work actually needs. When the engagement ends, access ends with it, and offboarding is part of the handover checklist.

Auditable by default

Because the work happens in your infrastructure, your existing logging and audit trails cover it. There is no shadow environment to reconcile after we leave.

Small teams, named people

Every engagement is two or three named builders. You know exactly who has access to what, because the list is short enough to read.

Questions, questionnaires, reports.

For the SOC 2 report, a security questionnaire, or to report a vulnerability, email hello@gatsby.company. Security mail gets read first.