Security & Trust Center
SOC 2 & Compliance Standards · Last updated: August 23, 2026
Month's End is engineered from day one to uphold the highest enterprise security, confidentiality, and data integrity standards across the entire reporting lifecycle.
1. SOC 2 Trust Services Criteria Alignment
Our infrastructure and development practices adhere strictly to the five AICPA SOC 2 Trust Services Criteria:
- Security: Protected by Cloudflare Enterprise DDoS shielding, Web Application Firewall (WAF), rate-limiting, and strict Content-Security-Policy (CSP) headers.
- Confidentiality: Google OAuth
access_token and refresh_token strings are encrypted at rest using AES-256-GCM with hardware-derived cryptographic initialization vectors.
- Processing Integrity: Automated PDF generation engines strictly mirror raw telemetry from Google Analytics 4 and Search Console APIs without modification.
- Availability: Serverless edge deployment distributed over 300+ Cloudflare global data centers ensuring low-latency delivery and 99.99% uptime.
- Privacy: Built with zero-tracking analytics and strict GDPR Article 15/17 compliance, enabling instant data exports and irreversible account purging.
2. Cryptographic Architecture & Key Management
- In Transit: All HTTP traffic is enforced over TLS 1.3 with HSTS preloading (
max-age=31536000; includeSubDomains; preload).
- At Rest: Sensitive credentials are encrypted with AES-256-GCM via PBKDF2 key derivation from cryptographically isolated edge secrets.
- Authentication: Session authentication utilizes passwordless CSPRNG 6-digit magic codes with rate limits and 5-attempt brute-force lockouts.
3. Least-Privilege API Architecture
We believe in absolute data minimization. Month's End never requests administrative or write access to your analytics or search data:
- Google Analytics 4: Read-Only (
analytics.readonly)
- Google Search Console: Read-Only (
webmasters.readonly)
4. Subprocessor Governance
We work exclusively with SOC 2 / ISO 27001 certified global cloud providers:
- Cloudflare, Inc.: Edge compute, distributed SQL storage (D1), and perimeter WAF (SOC 2 Type II, ISO 27001).
- Paddle.com Market Ltd: PCI-DSS Level 1 compliant Merchant of Record for global checkout and billing.
- Resend, Inc.: SOC 2 Type II compliant enterprise transactional email infrastructure.
5. Responsible Vulnerability Disclosure