No badges we haven't earned. This page lists what's actually in place — and nothing that isn't.
The site and our applications run on Google Cloud.
TLS 1.2 or higher on every connection. Certificates issued and rotated via Let's Encrypt.
Nightly encrypted database backups with 14-day retention.
On Trove, tenant data is isolated with Postgres row-level security — enforced at the database layer, not just in application code. A query can't reach another tenant's rows even if the application asks for them.
One person has production access: Kelly, the founder. That's the honest shape of a company this size — no sprawling admin list, no contractor you've never heard of, and no pretending otherwise. The single-operator risk is exactly what the escrow and continuity terms on How you're protected exist to cover.
SOC 2 is on the roadmap — controls first, certification when the observation window completes. The badge goes up when the audit is real, not before.
Found something? security@gage.industries. We read it, we respond, we fix it. Machine-readable details at /.well-known/security.txt.