Trust center
How we protect your data.
MonsterCloud processes sensitive prompts for regulated companies. This page documents our controls in plain language.
Compliance
SOC 2 Type II
Audit period ending June 2026
Privacy
GDPR · KVKK
EU representative appointed
Framework
ISO 27001
Certification in progress
Testing
Annual pentest
Third-party, summary on request
Data handling
- Prompts and completions are never used to train any model.
- Default request log retention is 30 days; Zero Data Retention mode stores only metadata.
- PII redaction runs before data leaves our network to a model provider.
- Customers can delete a workspace and all associated data via API at any time.
Infrastructure
Hosted on AWS in eu-central-1 (Frankfurt) and us-east-1 (Virginia). Workloads are isolated per tenant at the database and encryption-key level. All data is encrypted with AES-256 at rest and TLS 1.3 in transit. Enterprise customers can supply their own KMS keys.
Access control
Employee production access requires hardware security keys, is just-in-time, and is logged. Customers get SSO/SAML, SCIM, role-based access and an immutable audit log.
Subprocessors
| Vendor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting | EU / US |
| Anthropic | Model inference (when selected) | US / EU |
| Stripe | Payments | US |
| Postmark | Transactional email | US |
Data Processing Agreement
Our DPA includes the EU Standard Contractual Clauses and a KVKK addendum. It is incorporated into our Terms of Service; signed copies are available from legal@monstercloud.ai.
Vulnerability disclosure
Report issues to security@monstercloud.ai. We acknowledge within 24 hours and do not pursue legal action against good-faith research.