How we protect your data
Eight things a client’s IT team will ask about.
Each one is a control in our SOC 2 Type II audit or a commitment in our terms – and the controls’ live status is on the trust center for anyone to check.
-
SOC 2 Type II
Topliner is audited against SOC 2 Type II by an independent auditor. The 59 controls behind it – access, encryption, change management, continuity, people – are monitored continuously and published on our trust center.
-
Hosted in the EU
Every production server runs in a data centre in Germany, and the application reaches its database and cache over a private network. Backups are kept off-site, in a separate region in France.
-
Encrypted in transit and at rest
Every connection to Topliner is encrypted with TLS 1.2 or later. Data is encrypted at rest, backups are encrypted with AES-256, and the keys to the services you connect are stored encrypted.
-
Never used to train AI
We do not use your searches, candidates, notes or anything generated from them to train AI models, and we never sell or rent data. That is a commitment in our terms of service, not a setting.
-
Your workspace is yours
Data is shared only inside your workspace and is never shared between firms. A restricted search has its own access list, and clients see only the searches you share with them. Inside Topliner, access is limited to the engineering and support staff who run the platform.
-
Protected sign-in
Accounts are by invitation only, and every sign-in is recorded. An admin signing in from a new browser, country or network confirms it with an emailed code – so does granting admin powers. Trusted browsers are listed on your profile, and you are told by email when one is added.
-
Backed up continuously
Every change to the database is archived as it happens, so it can be restored to any point in time. Full and daily backups are kept off-site, and recovery is tested under a written continuity plan.
-
Watched around the clock
Servers, databases and the application report to the engineering team in real time, and incidents follow a documented response plan. Dependencies are scanned for vulnerabilities and patched against fixed deadlines.
AI with guardrails
AI on your searches, with guardrails.
-
Names come out first
Before a model reads your team’s notes to write a person’s Insights, their name, emails and phone numbers are masked.
-
Restricted stays restricted
Notes from a restricted search are left out of what the AI reads, so a confidential mandate does not surface in someone else’s view.
-
A person checks the work
A researcher reviews the work on every search, so nobody is ruled out by a model on its own.
-
Your data, not training data
What you put into Topliner is used to run your searches, and for nothing else.
People and disclosure
The people behind the platform.
- Background checks for everyone who joins
- A confidentiality agreement signed on the first day
- Security training when they start, and every year after
- Multi-factor authentication on every staff account
Found something? Tell us.
Good-faith research is welcome, and we will not pursue it. Tell us what you found, how to reproduce it and what it affects.
- 5business daysto acknowledge your report
- 7daysto fix a critical issue
- 30daysto fix a high one
- 90daysto fix a medium one
Questions
Questions from security teams.
Where is our data hosted?
In the EU. Production runs on servers in Germany, and encrypted backups are kept in a separate region in France. Some providers that process specific requests are based in the US – among them, AI queries through the copilot and the sourcing of profile data – and those transfers are covered by EU Standard Contractual Clauses.
Is our data used to train AI models?
No. We do not use your searches, queries, candidates or anything generated from them to train AI models, for benchmarking, or for any other commercial purpose. It is written into our terms of service.
Who at Topliner can see our data?
Only the engineering and support staff who operate the platform, and only to run and maintain it. Everyone at Topliner passes a background check, signs a confidentiality agreement and completes security training every year.
Can we see the SOC 2 Type II report?
Yes, under NDA. Request it through our trust center, or write to security@topliner.app.
What happens to our data if we leave?
Your project data stays available to export for 90 days after the account closes, and we provide a complete export within 14 days of a request. Deletion requests are fulfilled within 30 days.
What if something goes wrong?
Every change to the database is archived as it happens, so it can be restored to any point in time, and incidents follow a documented response plan. The platform’s status is public on our status page.