Security and Trust Center

Commitment to Security and Privacy

Bowtie is built with security and compliance at its core. We implement industry-leading safeguards to protect customer data and align with major global privacy regulations, including the GDPR, CCPA, and other applicable data protection laws.

We continuously review and update our security measures to stay aligned with evolving standards and emerging threats.

Compliance and Privacy Frameworks

Bowtie’s privacy and data-handling practices are designed to support compliance with:

• EU General Data Protection Regulation (GDPR)
• UK GDPR
• California Consumer Privacy Act (CCPA/CPRA)
• Other applicable regional privacy frameworks

Our product, internal operations, and contractual terms are structured to ensure compliance for both Bowtie and our customers. For further details, you can request our security documentation.

Independent Security Testing

Bowtie engages independent, third-party security firms to perform annual penetration tests across our systems.

These assessments include:

• Application, API, and infrastructure testing
• Identification and verification of vulnerabilities
• Independent validation that mitigations have been applied effectively

Findings are reviewed and addressed as part of our continuous security improvement program.

Certifications and Audits

• SOC 2 Type II certification covering Security and Confidentiality
• Continuous monitoring and control validation through Vanta
• External auditors verify that controls are operating effectively

Redacted audit summaries or verification letters can be provided under NDA upon request.

Data Security

All customer data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Encryption keys are securely managed and rotated regularly.

Access to data is strictly limited to authorized personnel using role-based access control (RBAC) and multi-factor authentication (MFA).

Access Controls and Monitoring

• Principle of least privilege enforced across all environments
• Administrative access logged, monitored, and periodically reviewed
• Continuous security monitoring for anomalies and potential threats
• Regular internal reviews of access configurations and permissions

Incident Response and Breach Management

Bowtie maintains a documented incident response plan with defined escalation, containment, and communication procedures.

Incidents are investigated immediately, and customers are notified when their data may be affected, in accordance with applicable regulations.

Our response processes are periodically tested and refined to ensure readiness.

Infrastructure and Resilience

Bowtie is hosted on Amazon Web Services (AWS), leveraging its world-class physical and network security infrastructure.

Our architecture includes:

• Network isolation within secure VPCs
• Redundant systems and regular backup validation
• Disaster recovery and business continuity plans designed to ensure high availability

Secure Development and Employee Practices

Security is embedded throughout our development lifecycle.

• All code changes undergo peer review and automated security scanning
• Regular vulnerability scans and dependency updates
• Developers trained in secure coding and data protection practices
• All employees complete security and privacy training upon onboarding and annually thereafter

Vendor and Third-Party Management

Bowtie maintains a third-party risk management program to evaluate the security posture of all vendors.

Vendors must meet our minimum security standards and agree to contractual obligations protecting customer data.

Ongoing assessments ensure that third-party providers maintain compliance throughout the relationship.

Transparency and Contact

We believe trust is built on transparency.

Customers may request documentation, audit summaries, or additional details about our security program by contacting us.

For information on how we handle personal data and privacy rights, please visit our Privacy Policy.