Plugin Security

Trust Count to keep your data secure

Ensuring our users not only have easier access to their data but that it is always secure and in their control is at the core of Count's design. We pride ourselves on having world-leading technology and this includes the security measures we put into Count and the procedures which describe how we work as a team.

Meet your compliance requirements

Security and trust are integral at Count. We have achieved audit certification for Service Organization Controls (SOC 2) Type II, with a focus on the Security trust service criterion. This ensures our business and technology controls are independently audited annually. Please view our Trust Services Report, or contact hello@count.co for more information on our SOC 2 Audit report.

Security Program Highlights

User privacy, integrity, and authentication

  • HTTPS & SSL/TLS — Count requires all user communication to be through HTTPS (Hypertext Transfer Protocol Secure) using TLS (v1.2 and above). This ensures privacy, integrity, and authentication for all traffic to/from our website. We additionally employ HSTS to protect against potential downgrade attacks.
  • Cross site request forgery tokens — We verify CSRF tokens at every point to make sure your data can't be tampered with by malicious 3rd parties.
  • No passwords — We require users to authenticate using magic links or Google Auth. This means we never store their passwords and organisations can safely control their employees' access to Count. It also allows organisations to use and control two-factor authentication by default.

Session capture

  • Off by default — Capture and reasoning are both switched off until you turn them on, and sessions stay on your own machine until you do. You can pause reasoning at any time — for an hour, until tomorrow, or until you turn it back on — and pausing stops recording as well as uploading.
  • Encrypted in transit — When reasoning is on, your session is sent to our servers over an encrypted connection to generate your review.
  • Where it's processed — Count runs separate EU and US regions, and your session is processed and stored in the region of the account you're signed in to.
  • You're in control — You can delete any conversation at any time, which removes it from our systems. Deleting your account removes everything we hold for you.
  • Where your data goes — Claude (or your AI assistant) → Count Plugin on your machine → Count's servers, in your region → our review provider → back the same way to your Plugin. Your session only leaves your machine when reasoning is on, and it only ever travels between your assistant, the Plugin, and the servers that produce your review — never anywhere else.

Our servers

  • Server locations — Count offers both US and EU-based servers, all hosted by Google Cloud Platform. EU server hosting is available upon request — please contact our sales team to discuss this option. Access to all our servers is protected through two-factor authentication, and access is only given to a select number of Count employees.
  • Encrypted at rest — All the user information stored on our servers is automatically encrypted at rest.
  • Firewall — Our servers are private, meaning they are closed to all connections except those explicitly allowed by us.
  • Rate limiting — We limit the number of requests we can receive by a user to guarantee uptime to our customers and prevent DoS (denial of service) attacks.
  • Network edge security — Our website, application, and APIs are shielded by an advanced Web Application Firewall (WAF). This edge-based security allows us to continuously monitor and filter malicious traffic before it reaches our infrastructure.
  • Uptime and monitoring — We actively monitor our service status and our development team is immediately alerted if any issues occur. We alert users in advance of impending maintenance work on our site. Click here to check our service status.

Development process

  • Automated security checks on build — We have automated safeguards in place to check our code and hosting environments for potential issues before anything goes live.
  • Code reviews and standards — We draw on industry experience both internal and external to ensure our code is readable, maintainable and free from security vulnerabilities.

Customer data procedures

  • GDPR — We offer organisations a data protection agreement (DPA) as they sign up to Count so they can be GDPR compliant with Count acting as a data processor for them. Contact sales for a DPA.
  • Strict employee confidentiality — All our employees are required to sign an extremely strict confidentiality agreement before they are allowed any interaction with customer information.
  • Customer data — We place very strict controls over our team's access to customer data. Only a very small number of Count employees are allowed access to customer data and only for the purpose of helping customers when requested for support purposes. We require written permission before we can do this. We maintain logs of all users who access customer data.

Additional Security features

  • Security policies — Count has developed a comprehensive set of security policies covering a range of topics, including Access Management, Disaster Recovery and Business Continuity, Incident Response and Risk Management. These policies are updated frequently and all employees and contractors must agree to them annually. Access to some of our policies can be requested on our Trust Services Report.
  • Security training — All Count employees and contractors must complete security training at least annually.
  • Employee background checks — Count performs background checks on all new employees and contractors in accordance with local laws.
  • Employee laptop checks — All Count employee laptops are monitored remotely to ensure compliance with our security procedures, including checks on installed operating system version, antivirus software status, password manager usage and hard-drive encryption.
  • PCI — All payments made to Count go through our payment partner, Stripe. See Stripe's security page for details on their security and PCI compliancy.

Our Terms of Use and Privacy Policy provide further information on our legal obligations to our users.

‍