Trust center
How we protect your data and your platforms
For security, procurement and risk teams reviewing Metric Oak.
- SOC 2
- In progress
- Where your data lives
- In your cloud accounts
- Security contact
- security@metricoak.com
Security practices
Data handling and access control
Least-privilege access
Engineers work in client environments through your identity provider, with role-based, time-bound access that is reviewed and revoked at project end.
No client data on laptops
Work happens inside your cloud accounts. We do not copy production data to Metric Oak systems or personal devices.
Managed devices
Company laptops with full-disk encryption, endpoint protection, automatic updates and screen lock.
MFA everywhere
Multi-factor authentication is enforced on every Metric Oak system and required for all client access.
Secure engineering
Code review, secret scanning and infrastructure as code for everything we build. No credentials in repositories.
Incident response
A documented process with prompt client notification of any confirmed incident affecting client data, within the deadlines in your contract.
Sub-processors
Third parties that process data for us
| Vendor | Purpose | Location |
|---|---|---|
| Calendar booking, email and documents | Global | |
| Microsoft Clarity | Website analytics (only with your consent) | US |
| Contabo | Website hosting (no client data) | EU |
Policies
Download our policies
Security questionnaires
We complete SIG Lite, CAIQ and custom questionnaires, and sign NDAs before sharing detailed evidence.
Email security@metricoak.comHave 30 minutes? Get a senior architect’s view of your data platform.
No sales deck. You talk to the engineer who would lead the work.
Book an architecture review