Trust Center

Security and data handling, stated plainly.

This page describes the controls in place today and marks everything else honestly. We do not claim certifications we do not hold.

Request security documentationSecurity policy

Controls

What protects a Dojo today

  • Tenant isolation

    Each Dojo is a separate tenant. Postgres row-level security scopes every tenant table to the active Dojo.

    In place

  • Role-based access

    Owner, admin, manager, member, partner and client roles, with least-privilege defaults per Dojo.

    In place

  • Integration credentials

    Vendor tokens and keys are encrypted with AES-256-GCM before storage and are never shown back in the interface.

    In place

  • Encryption in transit

    All traffic to the platform is served over HTTPS (TLS).

    In place

  • Encryption at rest

    Data is stored with our hosting and database providers, which encrypt storage at rest.

    In place

  • Audit logging

    Administrative and platform actions are recorded with the acting user and time.

    In place

  • Multi-factor authentication

    MFA for Dojo sign-in is on the roadmap and not yet available.

    Planned

  • Regional data residency

    Dedicated UAE or Saudi hosting is not generally available today. Discuss requirements with us before contracting.

    On request

Certifications

Current certification status

Dojo360 does not currently hold these certifications or attestations. We will update this page with evidence when any of them is completed, and will not publish target dates until they are approved.

  • SOC 2Not certified
  • ISO 27001Not certified
  • ISO 42001Not certified
  • Independent penetration testNot certified

Data flows

How data moves between your systems and Dojo360

What Dojo360 reads

Only the records each connected vendor exposes to the access your team grants, such as contacts, deals, invoices or orders.

What Dojo360 writes

Write-back happens only where a vendor permits it and the connector supports it. Each marketplace listing states its access level.

AI and your data

AI-assisted features run only where enabled for your Dojo. Actions that change records in another system require an approved workflow.

Disconnecting

Disconnecting an integration deletes its stored credentials. Data export and deletion on request are handled by our team.

Report a concern

Found a vulnerability or have a security question?

Contact our team through the security contact form. Detailed security documentation is available under NDA for qualified prospects. Subprocessor details are listed in our privacy policy.

One hub

Ready to run it as one operation?

Pick the native apps you need, connect the ones you already have, and see your Dojo price live. Or start with a fixed-price Blueprint and we'll map it for you.

Build your Dojo Start with a Blueprint