Compliance built into every layer

SOC 2 Type II

Trust Services Criteria

Annual audit by an independent CPA firm covering Security, Availability, Confidentiality, Processing Integrity, and Privacy trust service criteria. Full report available to Enterprise customers under mutual NDA.

GDPR

EU General Data Protection Regulation

Full compliance with GDPR for processing personal data of EEA data subjects. Standard Contractual Clauses (SCCs) and EU-U.S. Data Privacy Framework available for international transfers. Data Protection Officer appointed. Article 30 records of processing maintained.

ISO 27001

Information Security Management

TerraBog's information security management system is aligned with ISO 27001 requirements. Certification audit is in progress with an expected completion date of Q2 2026.

CCPA / CPRA

California Consumer Privacy Act

Full compliance with CCPA and CPRA requirements for California residents. TerraBog does not sell personal information. Data subject request workflows are available to all customers through account settings and via privacy@terrabog.com.

PIPEDA

Canadian Personal Information Protection

Compliance with PIPEDA for processing personal information of Canadian residents. Data enrichment from Statistics Canada uses only publicly available aggregate data. Cross-border transfer protections in place per DPA.

PCI DSS

Payment Card Industry Data Security Standard

TerraBog does not store, process, or transmit cardholder data on its own systems. Payment processing is handled exclusively by Stripe (PCI DSS Level 1 certified). Our automated PII detection identifies and masks credit card numbers in uploaded datasets via Luhn algorithm validation. SAQ-A applicable.

Uploaded files are validated for format, encoding, and size limits. Files are stored in tenant-isolated GCS paths with server-side encryption.

Automated data validation checks column schemas, null rates, and data types. Deep cleaning normalizes strings, numbers, dates, phone numbers, and email addresses. A 50% pass-rate gate prevents corrupt data from entering the warehouse.

Credit card numbers (Luhn validation), Social Security Numbers, and bank account numbers are automatically detected and masked. Rows with PII findings are quarantined for review in the Data Quality dashboard.

Cleaned data is canonicalized into standard schemas (orders, order_items, customers, products) and loaded into BigQuery via idempotent MERGE operations using row_hash. All tables are partitioned by date and clustered by tenant_id.

dbt models transform canonical data into analytics-ready mart tables. BigQuery ML models run scoring for customer segmentation, revenue forecasting, and fraud detection. All transformations are version-controlled and auditable.

Public data enrichment (FRED, Census, Statistics Canada) is performed server-side. No customer data is sent to enrichment sources. AI insights are generated via Claude AI with tenant-scoped queries only.

For Enterprise

Compliance package for enterprise procurement

Enterprise customers can request a comprehensive compliance kit to satisfy their security review and vendor assessment requirements.

Compliance contacts

Reach the right team