> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linkup.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

SOC 2 Type II, Zero Data Retention, GDPR, and Single Sign-On ship on every Linkup tier. For customers with the highest data sovereignty requirements (banks, government, defense, regulated healthcare), the full Linkup index and infrastructure deploy inside the customer's own VPC: Bring Your Own Cloud. Queries never leave that environment.

<Card title="Trust Center" icon="shield" href="https://trust.linkup.so/" horizontal>
  SOC 2 reports, subprocessor list, and policy documentation.
</Card>

## Bring Your Own Cloud (BYOC)

For the highest data sovereignty requirements, Linkup deploys the full search index and processing inside the customer's virtual private cloud. Properties:

* Queries never leave the customer's environment.
* Search results never leave the customer's environment.
* The Linkup index is replicated inside the VPC and updated through the customer's egress controls.
* Suitable for banks, government, defense, and regulated healthcare buyers who cannot route queries to a third-party SaaS.

BYOC is a contracted offering. Contact `support@linkup.so` to scope a deployment.

## Certifications and compliance

* **SOC 2 Type II** certified. Security, availability, and confidentiality controls. Report available upon request.
* **GDPR** compliant. EU data residency available.
* **Zero Data Retention** available on every tier.
* **Single Sign-On**, IP whitelisting, role-based access.

## Data encryption

* **In transit**: TLS 1.2+ for all API communications.
* **At rest**: AES-256 for any stored data.
* **Key management**: enterprise key management services with strict access controls.

## Infrastructure security

* **Cloud infrastructure**: hosted on Microsoft Azure with EU and US regions.
* **Network security**: VPC segregation, network segmentation via security groups and ACLs, multi-layer firewalls, DDoS protection, no public database endpoints.
* **Hardening**: baseline configurations, timely patching, least-privilege service roles.

## Privileged access management

<Callout type="success" icon="check" title="RBAC + MFA">
  Privileged and administrative access requires multi-factor authentication with strict role-based access control.
</Callout>

<Callout type="success" icon="check" title="Monitored privileged access">
  All privileged access is logged, continuously monitored, and regularly reviewed.
</Callout>

<Callout type="success" icon="check" title="Least privilege and JIT">
  Access follows least-privilege principles with just-in-time elevation where applicable.
</Callout>

## Vulnerability management and secure development

<Callout type="success" icon="check" title="Quarterly vulnerability scanning">
  Independent scans (Bastion Technologies) with tracked remediation.
</Callout>

<Callout type="success" icon="check" title="Annual penetration testing">
  Independent assessors validate controls and exploit paths.
</Callout>

<Callout type="success" icon="check" title="Continuous monitoring">
  Automated threat detection and alerting across infrastructure and apps.
</Callout>

<Callout type="success" icon="check" title="Remediation SLAs">
  Defined timelines by severity for fast, predictable fixes.
</Callout>

<Callout type="success" icon="check" title="Security-by-design SDLC">
  Design reviews, code scanning, dependency checks, and secure API patterns.
</Callout>

<Callout type="success" icon="check" title="Staff security training">
  Regular training to maintain security awareness and best practices.
</Callout>

## Crawling safeguards

<Callout type="success" icon="check" title="AI-powered filtering">
  Blocks malware, phishing, and malicious sources before indexing or serving.
</Callout>

<Callout type="success" icon="check" title="Result curation safeguards">
  Ranking protects against sensitive and prohibited content exposure.
</Callout>

<Callout type="success" icon="check" title="Web filtering and DNS security">
  High-risk sites are automatically blocked.
</Callout>

<Callout type="success" icon="check" title="Configurable domain exclusions">
  Control results via the `excludeDomains` API parameter.
</Callout>

<Callout type="success" icon="check" title="Ethical crawling standards">
  Respect for `robots.txt`; no circumvention of CAPTCHAs or access controls.
</Callout>

## Custom requirements

We accommodate custom breach notification timelines, tailored remediation SLAs, dedicated security reviews, and bespoke compliance reporting on contracted plans. Contact `support@linkup.so`.