Security & Privacy

Modem connects to your team’s communication and development tools to aggregate user feedback. That means we handle your data carefully. This page explains what we do to keep it safe.

​

Compliance

We are pursuing SOC 2 Type II certification. Contact us for details on progress and timeline.

​

Data Protection

• Encryption. All data is encrypted at rest and in transit using TLS 1.2+. This covers messages, user profiles, and any files Modem processes.
• Access controls. Employees only access customer data when there is a documented business need. All production access requires multi-factor authentication and is logged.
• Assessments. We run quarterly vulnerability scans on public-facing systems and annual penetration tests by independent firms.

​

Data Access and Sharing

No third-party data sharing. We do not sell or share your data with third parties for their own purposes. Data is only shared with service providers necessary to operate Modem.

​

Technical Safeguards

• Tenant isolation. Database queries pass through an application-level ORM wrapper that enforces organization-scoped filtering. PostgreSQL Row-Level Security policies provide a second layer of enforcement at the database level, preventing cross-tenant access even in the event of an application bug.
• Token encryption. OAuth tokens from connected services (Slack, GitHub, Linear) are encrypted at rest using AES-256-GCM with per-token initialization vectors before being stored in the database.
• Signed media URLs. When Modem proxies images or files from third-party services, it uses HMAC-SHA256 signed URLs with time-limited expiry. The original source URLs are never exposed to the browser.
• Webhook verification. Inbound webhooks from GitHub, Linear, and other services are verified using HMAC-SHA256 signature checks with constant-time comparison before processing.
• Minimal access. Integrations with third-party services only request the scopes necessary for the product to function.
• Input validation. All API inputs are validated against strict schemas at the boundary before reaching application logic.

​

Data Retention

• While your organization exists. We retain your data for as long as your Modem organization exists.
• After cancelling a paid plan. Cancelling moves your organization to our free tier. Your data is retained so you can keep using Modem or resubscribe; it is not deleted by cancellation alone.
• On deletion. Deleting your organization permanently removes its data from our production database. You can also request deletion at any time — see below.
• Backups. Deleted data is purged from encrypted backups within 90 days and is never restored into production.

​

Requesting Deletion

You can request deletion of your data at any time by emailing support@modem.dev with the subject “Data deletion request”. Tell us the scope: your whole organization, a connected workspace, or a named individual. We verify that the requester is authorized within 2 business days, complete the deletion within 3 business days of that verification, and confirm in writing what was deleted and when. Requests are accepted from an admin of the Modem organization, an admin of the connected workspace, or the individual whose data is the subject of the request.

​

Incident Response

If we discover a security incident affecting your data, we notify you as soon as reasonably possible with details about what happened and what we are doing about it. We comply with all applicable breach notification laws. After any incident, we conduct a review to identify root causes and prevent recurrence.

​

Reporting a Vulnerability

If you discover a potential security vulnerability, report it to security@modem.dev. We appreciate responsible disclosure and do not take legal action against researchers who act in good faith.