Trust center
Everything your security review will ask for.
Request the SOC 2 Type II report, read our policies and subprocessors, and find the right contact for security, privacy and billing questions.
- SOC 2 Type IIReport available under NDAin place
- GDPRDPA with SCCs for every customerin place
- HIPAABAA available on requestin place
- India DPDP ActGrievance Officer appointedin place
- Penetration testAnnual, third partyin place
- Zero Payload RetentionEnforced in every PoPin place
contact: security@palmsouqltd.com
SOC 2 Type II
Request the report.
The report covers the gateway, metering pipeline, dashboard and the people and processes behind them. We share it under a mutual NDA.
- Trust services criteria: security, availability, confidentiality
- Includes the penetration test summary letter
- Bridge letter available between audit periods
Policies
Available to customers and active evaluations on request.
| Policy | Review cadence |
|---|---|
| Information security policy | Annual |
| Zero Payload Retention standard | Annual, and on every gateway release that touches request handling |
| Access control and least privilege | Annual; access reviews quarterly |
| Encryption and key management | Annual |
| Incident response plan | Annual, with a tabletop exercise |
| Business continuity and disaster recovery | Annual, with a failover test |
| Vendor and subprocessor management | Annual |
| Secure development lifecycle | Annual |
| Data retention and deletion | Annual |
| Vulnerability management and disclosure | Annual |
Subprocessors
Cloudflare, Inc.
Edge network, routing, secrets for edge nodes
Amazon Web Services, Inc.
Regional control planes, metering store, AWS KMS
Google Cloud (Google LLC)
Analytics warehouse for aggregated reporting
Datadog, Inc.
Infrastructure monitoring, no payloads
Stripe, Inc.
Billing for PALM SOUQ's own invoices
Postmark, Slack, Zendesk
Email, alert delivery and support ticketing
Model providers and billing platforms you connect are not PALM SOUQ subprocessors. Full list with locations and data handled: subprocessors.
Penetration testing
Annual, independent
Gateway, dashboard and APIs tested by a third party each year and after major architecture changes, plus a public vulnerability disclosure program at security@palmsouqltd.com.
Availability
99.999% SLA on Scale
280+ edge PoPs and fail-open SDKs. Live and historical uptime by region is on the status page.
Zero Payload Retention
In memory, in flight only
The gateway reads payloads in memory while a request is in flight, to count tokens and run loop checks. Loop checks use derived signals (hashes, fingerprints) that cannot be turned back into text and are discarded after the detection window. Prompts and completions are never written to disk, logged or used for training.
Contacts
| Security and vulnerability reports | security@palmsouqltd.com |
| Privacy and data protection | privacy@palmsouqltd.com |
| Grievance Officer (India) | Kabir Sethi, Head of Security & Compliance, via privacy@palmsouqltd.com |
| Billing inquiries | support@palmsouqltd.com |
| Contracts, DPA and BAA | legal@palmsouqltd.com · DPA · BAA |
Questions, answered
How do I get the SOC 2 Type II report?
Use the request form on this page. We send the report under a mutual NDA, usually within one working day for customers and active evaluations.
How often is PALM SOUQ penetration tested?
An independent firm tests the gateway, dashboard and APIs once a year, and after major architecture changes. A summary letter is available with the SOC 2 report.
Will you fill in our security questionnaire?
Yes. Send it to security@palmsouqltd.com. Standard questionnaires such as SIG Lite and CAIQ are answered within three working days.
How will we hear about new subprocessors?
Customers receive at least 30 days' notice before a new subprocessor is added, by email to the account's admins and on the subprocessors page.
Who handles billing questions?
Email support@palmsouqltd.com. Billing inquiries are answered by the support team.
Clear security review, then a 14-day production trial.
Most teams finish review with the SOC 2 report, the DPA and this page. Then route one service through PALM SOUQ and see per-tenant margin within an hour.
14-day free production trial · 100k requests included · no card required