Trust and security
Last updated 10 October 2026
Who can see your data
Every record belongs to an account, and the database enforces that ownership on each request — not the interface. A colleague sees an initiative only when its owner has invited them by email, and only the parts sharing allows. Nobody outside your account, including us, reads your initiative content in the ordinary course of running the service.
Encryption
Traffic is encrypted in transit with TLS. Data at rest is encrypted by the hosting platform. Sign-in credentials are never stored by us in readable form; passwords are hashed by the authentication service.
Access control and single sign-on
Accounts sign in with email and password or with Google. Company single sign-on (SAML 2.0 — Okta, Microsoft Entra ID, Google Workspace) is offered to Institution accounts as a guided setup with your IT team: send us your provider's metadata address and the email domains it covers, and we confirm a go-live date in writing. Funder and advisor access is role-based, time-limited and can be revoked instantly, cutting off live sessions.
Governance controls for institutions
Funding releases can require two independent approvers, signed decisions with recorded consent, and verified evidence before a tranche is ready. Audit records are hash-chained and cryptographically signed with rotating keys, so any later change is detectable and older records stay verifiable. Policy authors cannot publish their own changes.
Activity log
Changes that matter — invitations, commitments, verifications, archives, connection changes — are recorded with the person and the time, and account owners can export the record as a spreadsheet at any time.
Where your data lives
Application and database hosting run on managed cloud infrastructure with automated daily backups and point-in-time recovery. We confirm the hosting region in writing before you sign, and you can export your records (CSV and signed governance bundles) at any time.
Who else processes data on our behalf
Payments and invoicing are handled by Paddle as merchant of record; we never see or store card details. Transactional email is sent through our managed email provider. Coaching readings are generated by large language models through a managed AI gateway. Your content is not used to train those models.
Certification status
We are not SOC 2 certified. An audit takes an accredited auditor and months of collected evidence, and we will not claim it before it is true. The controls an audit examines — row-level access enforcement, encryption, an exportable activity log, centrally managed sign-in, backups and a named sub-processor list — are in place and described above. If a certification is a condition of your procurement, tell us and we will discuss timing.
Security questionnaire
Procurement teams can download our pre-filled security questionnaire covering access control, encryption, logging, sub-processors, incident response and certification status: download the security questionnaire. For anything it does not answer, write to support@outcomespalace.com.
Reporting a problem
If you believe you have found a security issue, write to us before disclosing it publicly and we will respond within three working days.