Trust Center
A brand is built on trust. Brands bring us what is most their own: their story, their voice, their campaigns before anyone else sees them. On Instama, many hands work on that brand at once: makers, marketers and the AI agents that work for them. That only works when everyone can see the rules that hold it together.
So we do not ask you to take our word for it. Transparency is one of our core values, and this center is where we practise it. We publish how the platform is built and run, which third parties receive data and why, and how long we keep it. The facts here are read from the same source that our automated tests check against the running code: if the platform changes and this center does not, our tests fail.
In short
- Your data is stored in the European Union and isolated per organisation by the database itself.
- Every person, key and AI agent reaches your data through the same checked rules.
Our commitments
- Your content stays yours. We never use it to train AI models.
- Client Data is stored in the European Union. Where a provider processes it elsewhere, it receives only what a request needs, under GDPR transfer safeguards.
- We notify the supervisory authority of a personal-data breach within 72 hours of becoming aware of it, and an organisation whose data is affected within 48 hours.
- We tell you at least 30 days before a new subprocessor starts processing Client Data.
- When an organisation's access ends, its data is deleted 60 days later, or within 30 days of a written request.
Certification
We are preparing for SOC 2 Type II and ISO/IEC 27001. Neither audit has taken place yet, so we hold no report or certificate, and we will not say otherwise. Our infrastructure providers are independently certified to both.
| Framework | Status | Where we are |
|---|---|---|
| SOC 2 Type II | Readiness | Controls are being formalised and evidenced ahead of an independent audit. No report exists yet. |
| ISO/IEC 27001:2022 | Readiness | The information security management system is being set up ahead of certification by an accredited body. No certificate exists yet. |
The Security page describes each control as it runs today, and says what is not in place yet.
Where your data lives
| Layer | Location |
|---|---|
| Database, file storage, authentication | European Union |
| Application and API | European Union |
| Website and its forms | European Union |
| Video rendering | European Union |
| Image and PDF rendering | European Union |
| Sign-in relay for connected accounts | European Union |
Contact
Security and privacy questions, a technical walkthrough, a security questionnaire or a request about your personal data: security@instama.co.