WHAT YOUR SECURITY
REVIEW NEEDS TO KNOW.

Data handling & tenancy

All tenant data lives in a single Postgres database (hosted on Neon), and tenant isolation is enforced at the database level, not just in application code. Every tenant-scoped table has FORCE ROW LEVEL SECURITY enabled with a policy that only allows access to rows matching the current session's tenant — so even a bug in our application logic can't return one company's rows to another's request. The one database role that can see across tenants (used only for legitimate cross-tenant operations like authentication bootstrap and background workers) is a distinct, narrowly-scoped role, separate from the role the application uses for normal request handling.

Text embeddings used for feed and search matching (via pgvector) live in the same Postgres instance under the same isolation model — we don't send tenant content to a separate, less-governed vector database.

Encryption

All traffic between your browser or app and Mucho Gusto travels over HTTPS/TLS — every domain in our stack (the marketing site, the web app, the API, and Clerk's authentication domains) is served over TLS, with no plaintext HTTP path for real traffic.

For encryption at rest: our database host, Neon, states that data is encrypted at rest as part of their own platform. We have not yet independently audited or separately documented that claim ourselves — if your review requires a first-party attestation beyond Neon's own published materials, ask us and we'll help you get the right documentation directly from Neon.

Authentication & provisioning

Authentication is handled by Clerk. We offer Google sign-in, Microsoft sign-in, and email/password with an optional SMS or authenticator (TOTP) second factor. On Scale and Enterprise, admins can enforce MFA org-wide and restrict which sign-in methods are allowed for their tenant.

We do not offer a dedicated enterprise identity-federation connection today — if your review specifically requires federating logins against your own identity provider, tell us before you buy so we can be upfront about fit.

We do offer real SCIM provisioning (RFC 7644, Users and Groups) on Scale and Enterprise — a per-tenant bearer token, stored hashed (never in plaintext) on our side, shown once at generation, and revocable/rotatable at any time from the admin console.

Access control & review

Application access is governed by a per-tenant admin flag that gates privileged actions (member management, billing, moderation, SCIM token generation); every change to that flag is recorded in an append-only audit log. We run a quarterly self-review of admin privileges, SCIM tokens, and directory-sync grants against a documented checklist.

Availability

Mucho Gusto is hosted on Render across separate services for the web app, API, and marketing site, all auto-deploying from our main branch. We do not currently publish a formal uptime SLA. Our operational monitoring today is reactive — we rely on host-level deploy/runtime logs and our internal audit log rather than proactive uptime or error-rate alerting; a dedicated monitoring/alerting layer is on our roadmap but not yet built. If uptime commitments are a hard requirement for your procurement process, contact us to discuss what an Enterprise agreement can commit to.

Incident response

We maintain a written incident response plan. Incidents are classified by severity at detection — from SEV-1 (confirmed or strongly suspected cross-tenant data exposure, or a full outage) down to SEV-3 (a real but not actively harmful issue) — and any incident touching customer video content, personal data, or authentication is treated as at least high severity by default, regardless of how it first looks.

• Containment comes first when it's in tension with full understanding — typically rolling back the offending change.
• Blast radius is confirmed against the real system (via audit log and direct database investigation), not assumed from the code.
• For any confirmed or plausible data exposure, we target notifying affected tenant admins without undue delay, and within 72 hours of confirming the incident meets that bar.
• Every SEV-1/SEV-2 incident gets a written post-incident review — timeline, root cause, what caught it (and what didn't), the fix, and what now prevents that class of issue from recurring.

Subprocessors

The vendors below process some category of Mucho Gusto data. We maintain an internal tracking document for DPA and SOC 2/security-report collection from each; that collection effort is in progress, not complete — ask us for current status on any specific vendor before you finalize a review.

Request a DPA

Need a Data Processing Agreement, a completed security questionnaire, or anything else for procurement that isn't covered above? Email us directly and we'll respond as the small, hands-on team we are — no ticket queue.