Sidekick Labs, Inc.
The technical and organizational measures Sidekick Labs maintains to protect customer data — for security reviews, due diligence, and as the security exhibit (Appendix II) to our data processing agreement.
Canonical: https://sidekicksecurity.ai/security · Effective: 2026-09-17 · Classification: Public
Security posture at a glance
Remote-first SaaS; production hosted exclusively in company-owned cloud projects.
Assurance
Written Information Security Program aligned to SOC 2 (Security, Availability, and Privacy) and ISO/IEC 27001; Type II examination and certification in progress.
Independent testing
Annual third-party penetration testing; independent third-party application security assessment; continuous automated scanning.
Encryption
AES-256 at rest; TLS 1.2+ in transit; mutual TLS between internal services.
Data handled
Within the Services, end-user account PII (name, email) and account security configuration, plus the email and security telemetry that customers connect for analysis — all processed on customers’ behalf. (Broader company data collection is covered by the Privacy Policy.)
Regulatory program
WISP compliant with the Massachusetts Data Security Regulations (201 CMR 17.00).
Contents
Commitments
Where Sidekick Labs processes personal data on a customer’s behalf, it commits to the following.
Process personal data only on the controller’s documented instructions.
Ensure personnel authorised to process personal data are bound by confidentiality.
Implement the technical and organizational measures set out below.
Engage sub-processors only under written obligations equivalent to these terms and subject to the controller’s authorisation.
Assist the controller, by appropriate measures, in responding to data-subject rights requests.
Assist the controller with its security, breach-notification, and data protection impact assessment obligations.
Delete or return all personal data at the controller’s choice on termination of services, unless retention is legally required.
Make available the information necessary to demonstrate compliance and allow for and contribute to audits.
Measures
The safeguards we apply across our people, processes, and infrastructure.
1. Encryption & pseudonymisation
Personal data encrypted at rest with AES-256 and in transit with TLS 1.2+.
Restricted data additionally protected in use; internal service-to-service traffic secured with mutual TLS.
Access to personal data scoped per user via identifiers derived from signed JWTs, not client-supplied parameters.
2. Confidentiality, integrity, availability & resilience
Per-customer data isolation enforced server-side at the application and database layers.
Application-level rate limiting and cloud-provider network-layer DDoS protection guard availability.
Managed, regionally redundant cloud infrastructure underpins service resilience.
3. Restoration & business continuity
Backups are automated and encrypted, with access-controlled retention and documented, periodically reviewed restoration procedures; backup coverage is being extended across all production data stores.
Infrastructure defined as code and re-provisionable from source.
A documented Business Continuity / Disaster Recovery plan defines recovery procedures and objectives.
4. Testing & evaluation of effectiveness
Annual third-party penetration testing of production applications and infrastructure (reports available under NDA).
Continuous automated SAST (static analysis) and secret scanning with push protection; dynamic (DAST) testing performed on demand and as part of annual penetration testing.
Annual internal risk assessments under the Risk Management Policy.
5. Access control & authorisation
Authentication delegated to a third-party identity provider (OAuth 2.0 / OpenID Connect); MFA enforced via single sign-on (SSO); passkeys (FIDO2/WebAuthn) supported as an approved phishing-resistant method.
Role-based access control with least-privilege, need-to-know provisioning and periodic access reviews.
No shared, default, or generic accounts for system or production access; such access is via individual named identities. Documented shared test accounts are permitted, with credentials held in an access-controlled password manager; any other shared account requires a documented, approved exception.
6. Protection during transmission
All external connections use TLS certificates from trusted public certificate authorities; OCSP stapling handled by the platform.
No self-signed certificates; authentication tokens carried in headers, never in URLs.
7. Protection during storage
Primary storage is in company-owned cloud projects; the most sensitive tier (Restricted classification) is prohibited from endpoint or paper storage.
Four-tier data classification (Public / Internal / Confidential / Restricted) with per-tier handling, segregation, and encryption requirements.
Full-disk encryption required on all company devices and enforced via MDM.
8. Physical security
Remote-first company with no data-holding offices; production infrastructure inherits the cloud provider’s data-center physical controls.
Endpoint security enforced through MDM and endpoint detection & response (EDR); documented home-office and coworking requirements.
9. Events logging
Cloud audit logs record administrative actions and data-access operations (who, what, when) without logging data content.
Application-level audit logging tracks user actions.
10. Secure configuration & hardening
Infrastructure managed as code with drift from declared state detectable; production runs minimal, approved base images.
Debug modes and authentication-bypass flags disabled outside local environments.
Changes ship via CI/CD with technically enforced merge gates — peer review, required automated checks, and branch protection — with additional review required for security-relevant changes.
11. Personnel security
Pre-employment background screening.
Confidentiality and IP assignment agreements required; sanctions policy for non-compliance.
Security and privacy awareness training completed within 30 days of hire, with ongoing reinforcement.
12. IT security governance & assurance
Designated Security & Privacy Officer (CTO) reporting to the CEO.
Written Information Security Program aligned to SOC 2 (Security, Availability, and Privacy) and ISO/IEC 27001 control frameworks.
Documented vendor management, risk management, and incident response programs.
Assurance evidenced through independent third-party penetration testing and alignment to recognized control frameworks (SOC 2, ISO/IEC 27001); reports available under NDA.
13. Data minimisation & quality
Only the personal data necessary to deliver the service is collected — user name, email, and account security configuration.
Account data is provided by the user and self-service editable, and is bound to the authenticated user identity, supporting accuracy and currency.
User data is not used to train AI models without the user’s opt-in, and third-party AI providers are contractually prohibited from using our users’ data to train their models.
Customer personal data processed on our customers’ behalf is not sold, rented, or shared with third parties for their own purposes.
14. Limited retention & erasure
Customer data retained only while the account is active; on closure, data is removed after a short grace period (target 14 days), except where longer retention is required by law, regulation, or a legal/contractual obligation (e.g. dispute resolution or fee collection).
Customers may request deletion at any time, and may export data via the application or API before closure.
Audit trails retained 15 months; disposal performed securely per classification requirements.
15. Incident response & breach notification
Documented Incident Response Policy covering severity classification, escalation, containment, notification, and post-incident review.
Affected customers notified in accordance with contractual terms and applicable breach-notification law.
Assistance provided to controllers in meeting their own notification obligations.
16. Accountability & data protection governance
A designated Security & Privacy Officer owns the security and data protection program.
Policies, procedures, and control mappings are documented, version-controlled, and reviewed on a defined cycle.
Records and evidence are maintained to demonstrate compliance, and Sidekick Labs cooperates with customer audits and due-diligence requests.
Sub-processors
Sidekick Labs engages the following sub-processors to help deliver its services. Each is bound by a data processing agreement, is contractually held to technical and organizational measures no less protective than those described here, and processes personal data only on Sidekick Labs’ documented instructions. Last updated: 2026-08-16. The current list is maintained at the canonical URL above.
Incorporation by reference
This document sets out the technical and organizational measures (the “Measures”) maintained by Sidekick Labs, Inc. and may serve as the security exhibit (Appendix II) to the Data Processing Agreement between Sidekick Labs, Inc. and its customers.
The current, authoritative version is published at https://sidekicksecurity.ai/security and may be incorporated by reference into agreements between Sidekick Labs, Inc. and its customers. A reference to this URL, or to “Sidekick Labs Technical and Organizational Measures”, incorporates this document as then in effect.
Sidekick Labs may update these Measures from time to time to reflect evolving practices, provided that no update materially diminishes the overall level of security. The effective date shown in the document header identifies the controlling revision.
Sidekick Labs, Inc. · Effective 2026-09-17 · Classification: Public