feat labs, inc. runs a hosted feature-flag platform; protecting Customer Data is core to the product. This page describes the technical and organisational measures we use. Enterprise customers can request additional documentation via support@feat.so.
Infrastructure
- Application tier on Cloudflare Workers (V8 isolates).
- Primary data store: managed Postgres, accessed via Cloudflare Hyperdrive.
- Static assets and avatars on Cloudflare R2.
- SDK datafiles served from Cloudflare Durable Objects pinned to the customer's region.
Encryption
- In transit: TLS 1.2+ for all customer-facing endpoints. HSTS on the marketing site and console.
- At rest: managed-service default encryption on Postgres, R2, and KV.
- Secrets: Wrangler-managed secrets for API tokens; no secrets in source.
Access control
- Role-based access control inside the product; principle of least privilege for staff access to production.
- Mandatory SSO and hardware-key MFA for staff access to admin tooling.
- Staff access is logged; access reviews on a quarterly cadence.
Vulnerability management
- Dependency scanning on every PR; critical patches inside 7 days.
- External penetration tests on an annual cadence once the product reaches GA.
- Responsible-disclosure contact: support@feat.so.
Incident response
Suspected security incidents are triaged by the on-call engineer per the internal IR runbook. Confirmed Personal Data Breaches are notified to affected customers without undue delay (and within 72 hours), with the information they need to fulfil their own notification obligations.
Backups and recovery
- Point-in-time recovery on Postgres (retention: 7 days).
- RPO target: 5 minutes. RTO target: 4 hours.
Sub-processors
We publish the current list at /legal/subprocessors with a subscribe form for change notifications.
Certifications
SOC 2 Type I scaffolding is in progress; Type II will follow the standard observation window. ISO 27001 is on the roadmap.
Contact
Email support@feat.so.