Security at Candu
Explore Candu’s security documentation, find our policies, or speak with our team about your review.
Technical details
Read about data management, encryption and infrastructure in our developer documentation.
Candu uses AWS infrastructure with redundancy and monitoring to support availability.
Content is served from Cloudflare + S3 CDNs so it loads in parallel with your own assets—no blocking requests, no layout shift.
The Candu SDK fails open: if our service is unreachable, your page still renders and records zero blocking errors.
Encryption
Encryption for data in transit and at rest.
Role-based
access controls
Fine-grained roles and SSO/SAML support.
Least-privilege model
Production data accessible only to on-call engineers.
Incident response
24×7 monitoring, <30-minute pager duty, and post-mortems shared on request.
Data segregation
Tenant data is logically isolated by Account ID; per-tenant AES-256 keys in AWS KMS keep every workspace cryptographically separate.
Uptime
Service-level commitments are set out in your agreement with Candu.
Privacy & compliance
GDPR / CPRA ready: no sale or share of personal data, EU storage by default, and DPA + 2021 SCCs available for every customer.
Staged SDK releases
Every SDK build graduates from staging → canary → GA.
Candu processes customer personal data on your behalf under our DPA. The agreement sets out processing instructions, sub-processor requirements, security measures, and return or deletion of data. Read the DPA.
Candu stores customer data on AWS in the EU. Contact our security team for the data-residency details relevant to your review.
Our DPA explains when customer data is returned or deleted, including legal-retention and isolated-backup exceptions. See Section 10 of the DPA.
Candu uses HTTPS for data in transit and encryption for stored data. Our security team can provide the details needed for your review.
SLA terms are set out in your agreement with Candu. Contact our team to confirm the commitments that apply to your plan.
No. Candu processes customer personal data on the customer’s behalf as a processor or service provider. Our DPA describes the permitted processing and disclosures.
Email [email protected]. We help customers respond to privacy requests under the DPA and applicable law.
See the Candu Sub-processors list linked from our DPA. Section 5 explains the terms for engaging and changing sub-processors.
The SDK loads asynchronously and serves published content through a CDN. Performance depends on your content and host application; test your experience in staging before publishing.
More questions? Contact our Security team.
Contact Security