What Camper does with your data
Camper sits between your identity provider and the systems your company runs on. That is a position that deserves scrutiny, so here is the current state — including the parts that are not finished.
Where compliance actually stands
Camper is in private preview and does not hold a SOC 2, ISO 27001 or any other third-party attestation today. Claiming otherwise would be the fastest way to lose the kind of customer this product is for. The engineering controls described on this page are real and in the codebase; the audit that would let someone else vouch for them has not happened yet.
If your procurement process requires an attestation before you can sign, tell us early — it moves the timeline, and it is useful to know which framework matters to you.
Security
Controls that exist today
Each item here is implemented, not planned. Where something is aspirational, this page says so.
Per-tenant envelope encryption
Every credential Camper holds — OAuth tokens, service account keys, SCIM bearer tokens — is sealed with a per-tenant data key using AES-256-GCM, with additional authenticated data binding the ciphertext to the tenant and connection it belongs to. Data keys are wrapped by a master key that can be rotated without downtime.
Secrets stay out of logs and queues
Background jobs carry identifiers, never credentials. Workers unseal what they need at the moment they need it. Access tokens, webhook secrets and private keys are never written to logs.
Tenant isolation by construction
Every domain query is scoped through an explicit tenant context rather than a convention someone has to remember. It is enforced in the data access layer, not in review.
Enterprise sign-in included
SAML and OIDC single sign-on, passkeys and multi-factor authentication ship to every customer. Security controls are not a pricing lever.
Nothing is written without a plan
Resource links go live through a dry run you approve. Camper cannot make a bulk change to your directory-linked resources that nobody looked at first.
Everything is attributable
Provisioning actions, SCIM pushes and operator changes land in an activity log with the actor recorded. Drift is surfaced for a human rather than silently corrected.
Data
What Camper stores
Camper needs enough to decide who belongs where. It deliberately does not need what is inside the resources it manages.
Identity data
Name, work email, IdP identifiers, org placement and role attributes pushed by your IdP over SCIM
Resource data
Names, identifiers and membership lists of the groups, drives, channels and teams you link
Credentials
OAuth tokens and API credentials for the systems you connect, sealed at rest
Not collected
File contents, message contents, calendar event contents, or anything inside the resources Camper manages
Subprocessors
Who else touches it
The list is short because the architecture is boring on purpose. It will be kept current here.
| Subprocessor | Purpose | Region |
|---|---|---|
| Google Cloud Platform | Application hosting, Postgres, Redis, secret storage | us-central1 |
| Stripe | Payment processing and subscription billing for paid plans | United States |
| Resend | Transactional email (sign-in codes, password reset, invitations) | United States |
| GitHub | Source control and build pipeline (not a runtime host of tenant data) | United States |
Availability
Status and incidents
Live platform status and incident history are on our public status page, and the same signal shows in the dashboard sidebar. Incident communication also goes to affected tenants by email, and you can always reach a human directly.
Reporting a vulnerability
Send findings to security@getcamper.io. We will acknowledge within two business days. There is no bounty programme yet, and we will not pretend there is — but we will credit you, and we will fix it.
Please do not run automated scans against production tenants. If you want a target, ask and we will stand one up.
Legal documents
Terms of Service and Privacy Policy describe contractual use of Camper and how personal data is handled. They are grounded in how the product works today.
Security review questions welcome
Send the questionnaire. We would rather answer it honestly now than discover a blocker after you have committed.