Skip to contentScaled Abundance
Trust center

How we look after your company's data.

This page sets out what Honeycomb does today to keep your company's data safe, the documents you can read or ask for, and every third party that processes your data for us. Where something is not in place yet, it says so.

Start a security reviewRequest documentsAsk a question
Status

System status

System status

Honeycomb is up, but some work is running late.

  • AppWorking normally
  • DatabaseWorking normally
  • Agents and schedulesRunning late

Uptime history comes with our status monitor.

Checked 2026-11-12 03:23 UTC. Full status page

Compliance

Certifications

We do not hold a security certification such as SOC 2 or ISO 27001 yet, so you will not see a badge here. SOC 2 Type II is on our roadmap and is not under way. Until then, here is what Honeycomb does today, built into the product.

Security

What we do today.

The same practices as on our home page, built into the product.

  • Read-only by default

    Agents read your systems and prepare the work from day one. When work needs to write, your company decides: high-risk actions such as deletes, refunds and sends start switched off, and changes go to a person for approval or follow approval rules your company sets.

    Read-first

  • Per-company isolation

    Every fact, run and approval belongs to your company, and our servers only return it to people signed in to your company. Uploaded files are encrypted with a key per company.

    Company-scoped access

  • Encrypted connector credentials

    Every connector token and secret is encrypted with AES-256-GCM before it is stored. Call records keep the facts of a call, never its data or credentials.

    AES-256-GCM

  • Scoped app tokens

    Apps from the Software Factory never hold your passwords. They get short-lived tokens for approved systems only, and their write requests wait for approval.

    15-minute tokens

  • Every step on the record

    Every AI call, approval and change to what the brain knows is traced: who asked, what happened, when and why. Whenever you look back, you see exactly what happened and why.

    Full audit trail

  • Your company holds the controls

    Your company sets its own usage limits. The moment one is reached, work stops before the next AI call goes out, and any running agent can be stopped on the spot. Control stays with you.

    Owner-set limits

  • Invite-only access and SSO

    Sign-up is by invitation. Companies can sign people in through their own identity provider and turn off passwords for their domain.

    OIDC single sign-on

  • Outside data stays data

    Data read from connected systems is clearly marked and placed after a trust preamble, so the AI treats it as data, never as instructions.

    Injection mitigations
Documents

Documents

Read the policies here. Ask for the rest and we will send them to you.

AI

How AI uses your data.

AI and your data

No training on your data. Our AI providers do not use the data we send them to train their models, and we do not use your data to train models.

If your company brings its own AI provider key, retention for those AI calls follows your own agreement with that provider. Otherwise, it follows each AI provider's standard API data retention terms, as described in our Privacy Policy.

Legal

Subprocessors

The third parties that process customer data for us on our hosted service. Last checked 2026-11-11.

Our subprocessors

  • What it does
    Hosts Honeycomb: the web app, its server functions and scheduled jobs, and the server logs.
    Customer data
    Everything the app receives and sends while it runs, and server logs (the page or API path, and error lines with personal details removed).
    Where
    United States
  • What it does
    The Postgres database where Honeycomb stores your company's data.
    Customer data
    Accounts and companies, the company brain, uploaded files (encrypted with a key per company), connector credentials (encrypted), agent runs, approvals and usage records.
    Where
    United States
  • What it does
    The default AI model provider (Claude): answers, drafts, agent runs, building the company brain from what you connect and upload, and web search when it is on.
    Customer data
    The text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems. Web search queries when web search is on (a company can turn it off).
    Where
    See vendor
  • What it does
    Search embeddings for the company brain (text-embedding-3-small), for every company; also answers and web search when a company chooses OpenAI as its AI provider.
    Customer data
    The text of company knowledge and of searches, turned into embeddings. When chosen for answers: the text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems.
    Where
    See vendor
  • What it does
    Sends Honeycomb's account and security email: sign-up invitations, password resets, account-lock notices and sign-in alerts. We send no marketing email.
    Customer data
    The recipient's name and email address, and the message content.
    Where
    United States
  • What it does
    Our own company mailboxes, where the customer and privacy requests sent to our contact address arrive and where we reply.
    Customer data
    The emails people send us and our replies.
    Where
    United States

Optional AI providers

These are used only when a company chooses one in Settings, AI model, with its own API key. A company that brings its own key for any provider, Anthropic and OpenAI included, works under its own agreement with that provider.

  • What it does
    Answers, drafts and agent runs, when a company chooses Gemini with its own API key.
    Customer data
    The text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems.
    Where
    See vendor
  • What it does
    Answers, drafts and agent runs, when a company chooses Mistral with its own API key.
    Customer data
    The text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems.
    Where
    See vendor
  • What it does
    Answers, drafts and agent runs, when a company chooses DeepSeek with its own API key.
    Customer data
    The text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems.
    Where
    See vendor
  • What it does
    Answers, drafts and agent runs, when a company chooses Groq with its own API key.
    Customer data
    The text each request needs: the question or instruction, the relevant company knowledge and the data read from connected systems.
    Where
    See vendor

Systems your company connects

Systems your company connects, such as QuickBooks or FactSet, and your own sign-in provider for single sign-on, are your company's own vendors, not our subprocessors: Honeycomb works with them on your behalf, with the access you grant. See integrations

Changes to this list

We give 30 days' notice before a new subprocessor starts processing your data, so your company can object. Get notified of changes

Contact

Contact and responsible disclosure

If you think you have found a security issue in Honeycomb, email hello@scaledabundance.com with what you found and how to reproduce it. Please do not access other companies' data or disrupt the service while you look.

For anything else about this page, write to hello@scaledabundance.com.