Trust center
Bettermode is SOC 2 Type II compliant and built for GDPR and CCPA. We encrypt member data at rest and in transit and host it in the US or Germany. Your admins decide who gets in.
In short
The facts security and procurement teams ask for first.
Compliance
The legal documents are public and linked below. Premium customers can also get the SOC 2 Type II report from Sales.
The whole Bettermode platform is SOC 2 Type II compliant on every plan, covering security, availability, processing integrity, confidentiality and privacy. Premium customers can request the report from Sales.
Bettermode is GDPR and CCPA compliant. Its data processing agreement also covers UK GDPR and PIPEDA and includes EU standard contractual clauses.
SOC 2 Type II reportFor Premium customers, from Sales
Request the SOC 2 reportData protection
It starts in the infrastructure, well before anyone signs in.
Member data is protected with 256-bit encryption at rest and in transit.
Store your community’s data in the United States or in Germany for the EU. It’s on every plan.
Bettermode runs on Amazon Web Services, in data centers certified to SOC 2 and ISO 27001.
Our staff get only the access their job needs. We review it every quarter and remove it within 24 hours of someone leaving.
Access control lists block unauthorized requests, and a SIEM system flags suspicious activity.
Production and testing are kept apart. Growth and Premium also get a sandbox for trying changes.
Access controls
Decide who signs in and how, what each role can do and which sites can embed your community. The audit log shows what changed and who changed it.
Members sign in through your identity provider with OAuth2 or JWT on Growth and Premium, and admins and moderators can use SAML on Premium. Google, LinkedIn and Slack login work on every plan.
Set how strong member passwords need to be.
Add custom security headers to harden the browser against common attacks. Custom domains are served over SSL.
Admins, moderators, space admins and members each have their own permissions. Make the whole site or any space private or hidden.
Let the community be embedded only on domains you list, which protects members from clickjacking.
Premium keeps 90 days of admin and member activity, so you can see who changed what and when.
By plan
Every plan gets the essentials. Premium adds the controls larger teams ask for.
| Feature | Starter | Growth | Premium |
|---|---|---|---|
| SOC 2 Type II compliant platform | Included | Included | Included |
| Data residency in the US or EU | Included | Included | Included |
| Custom domain with SSL | Included | Included | Included |
| Roles, private and hidden spaces | Included | Included | Included |
| Moderation and AI spam detection | Included | Included | Included |
| Social login | Included | Included | Included |
| Cookie consent manager | Included | Included | Included |
| OAuth2 single sign-on | Not included | Included | Included |
| OneTrust and Usercentrics | Not included | Included | Included |
| Sandbox environment | Not included | Included | Included |
| JWT single sign-on | Not included | Included | Included |
| SAML single sign-on for staff | Not included | Not included | Included |
| SOC 2 Type II report | Not included | Not included | Included |
| Audit log, 90 days | Not included | Not included | Included |
| 99.9% uptime SLA | Not included | Not included | Included |
| Security and legal review | Not included | Not included | Included |
Plans as listed on bettermode.com/pricing.
How we work
These practices apply to our staff, our service providers and the data centers we run in.
Changes are scanned for vulnerabilities, and critical fixes go out first.
Nothing reaches production without going through QA.
On top of our own scans, outside specialists test the platform regularly.
Employees pass background checks under local law, complete security training every year and work on encrypted laptops.
A built-in policy and guidelines tool for your GDPR and CCPA pages, a cookie consent manager, and OneTrust or Usercentrics on Growth and Premium.
Live status for North America and Europe, with incident history, at status.bettermode.com.
FAQ
Yes. The whole Bettermode platform is SOC 2 Type II compliant on every plan, covering security, availability, processing integrity, confidentiality and privacy. Premium customers can request the report from Sales.
Yes. Bettermode is GDPR and CCPA compliant. Its data processing agreement also covers UK GDPR and PIPEDA and includes EU standard contractual clauses.
You choose the United States or Germany for the EU, on every plan. Bettermode is hosted on Amazon Web Services.
Yes. Members can sign in with OAuth2 or JWT on Growth and Premium, and admins and moderators can use SAML on Premium. Social login with Google, LinkedIn and Slack is on every plan.
Yes. Premium plans include an audit log that keeps 90 days of admin and member activity.
Yes. The full list, with what each vendor does and where it runs, is at bettermode.com/legal/subprocessors.
The data processing agreement, subprocessor list, privacy policy and terms of service are linked on this page. Premium customers can request the SOC 2 Type II report and a security and legal review from Sales.
Talk to sales and we’ll walk your team through how Bettermode handles your data.
