Security & Trust

Data Residency

Your data is hosted on US-based cloud infrastructure with managed PostgreSQL databases. Each environment runs on isolated instances.

Encryption

All data in transit is encrypted via TLS 1.2+. HSTS is enforced with a 1-year max-age, including subdomains, with preload.

Stored secrets (webhook keys, integration tokens) are encrypted using Fernet symmetric encryption. Database credentials and API keys are never stored in plaintext.

Tenant Isolation

All data queries are scoped to your organization at the database layer. There is no shared-tenancy data access — your traces, metrics, and logs are invisible to other organizations.

PII Redaction

Morse provides configurable PII redaction applied at ingestion time. Define regex patterns to strip sensitive data (API keys, emails, SSNs, etc.) before it is stored.

Redaction is org-configurable and applied before data hits the database.

Authentication

• API key authentication with SHA-256 hashing and scoped permissions (read / write / admin).
• Dashboard access via JWT with short-lived tokens and refresh rotation.
• Rate limiting on all authentication endpoints.

Security Headers

Every response includes hardened security headers: CSP with nonce-based script loading, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, and HSTS with preload.

CI/CD Security

Automated security scanning runs in CI on every pull request:

• Bandit — Python static application security testing (SAST).
• detect-secrets — pre-commit hook to prevent accidental credential leaks.
• pip-audit / npm audit — dependency vulnerability scanning.

Data Retention

Configurable retention periods based on your plan tier. Data is soft-deleted with a 24-hour grace period before permanent removal.

See the full Data Retention Policy for tier-specific details and deletion request procedures.

Status and Uptime

Live availability, per-service uptime history, and incident notes are published at status.morsehq.dev. We monitor the marketing site, the dashboard, and the API, and we post incidents there as we work them — including the ones that make us look bad.

We do not currently offer a contractual uptime SLA. The status page is the number, not a promise.

We Do Not Train On Your Data

Morse does not use your telemetry, traces, prompts, or completions to train, fine-tune, or develop any model. The Copilot and Anomaly Investigator send only the trace excerpts relevant to your question to our AI providers, after PII redaction, and those providers are contractually barred from training on API-submitted data.

Subprocessors

Every third-party service that touches customer data is named on our Subprocessors page, with what it processes and where. We notify account owners at least 30 days before adding a new one.

Certifications — Where We Actually Stand

We do not hold SOC 2, ISO 27001, or HIPAA attestations today, and we are not going to imply otherwise on a page about trust. What exists is above: the specific controls, the 72-hour breach commitment, and an open-source SDK you can read.

A third-party penetration test is scheduled before general availability, and its material findings will be remediated before launch. If your procurement process requires a formal attestation today, tell us at [email protected] — it moves our roadmap.

Breach Notification

We commit to notifying affected customers within 72 hours of confirming a data breach, consistent with GDPR Article 33 timelines.

Contact: [email protected]

Vulnerability Disclosure

We welcome responsible security research. See our full Vulnerability Disclosure Policy for scope, safe harbor, and reporting instructions.

Open-Source SDK

Our Python SDK is open-source — inspect the code that runs in your infrastructure before you deploy it. We believe transparency is fundamental to trust in the observability layer.