Client confidentiality. Clients are described rather than named in any public material unless they have agreed otherwise in writing. Displaced vendors aren’t named.

Where client data sits. Builds are deployed and maintained inside the client’s own environment, under the client’s own access, logging and retention controls. Reporting sits behind the client’s single sign on.

Encryption. Data is encrypted at rest and in transit.

Certifications. SOC 2 and ISO/IEC 27001:2022. Current certificates are available on request and are supplied as part of any security review.

Responsible AI. Deployments are governed by responsible AI controls and guardrails, including in federally regulated environments.

Competitive comparison. The comparison on our Why Candor page is based on publicly available information about the vendors named, as of the date shown. Product names are trademarks of their owners. Write to us if you believe an entry is out of date.

Contract terms are agreed per client. Ask for the data processing agreement, the security package or the master services agreement and we’ll send the current versions.