Trust & Privacy Center
The Segment Trust & Privacy Center
At Segment we are committed to protecting our customers’ information security and privacy. We run a security program with organizational and technological controls, encryption, access management, continuous monitoring and incident-response procedures. This page gives you transparency into how we protect systems, data and processes.
Compliance
ISO 27001
Our information security management system is certified to the international ISO 27001 standard, and we undergo regular external audits to ensure ongoing compliance.
ISO 27017
Our information security management system is also certified to ISO 27017, the extension of ISO 27001 for cloud services, which sets dedicated controls for securing cloud environments and for how responsibility is shared between the provider and the customer.
SOC 2
Our security controls are examined by an independent auditor in a SOC 2 report, based on the AICPA Trust Services Criteria.
Israeli Privacy Law Amendment 13
We are committed to protecting privacy and comply with Amendment 13 of the Israeli Privacy Protection Law, ensuring transparency and full control over your data.
Documents on request
Choose the document you need, or request access from our security team.
- ISO 27001 certificateRequest access
- ISO 27017 certificateRequest access
- SOC 2 reportRequest access
- Penetration test summary Restricted
- Information security policy Restricted
- Business continuity plan (BCP/DR) Restricted
- Sub-processor list Restricted
Infrastructure security
Data encryption
Data is encrypted in transit with TLS and at rest with infrastructure- and storage-level encryption. Encryption keys are managed under strict security procedures.
Traffic & application protection
A WAF and IDS/IPS systems monitor traffic in real time, alongside DDoS protection and rate limiting. All traffic and events are monitored 24x7x365 by our SIEM/SOC team.
Availability & resilience
Redundant architecture with local replication (LRS) and replication to remote sites (GRS/ZRS) for business continuity and fast recovery with a low RPO. We publish system status continuously.
Access control & permissions
Access follows the principle of least privilege, limited to operational need, with full control over permissions and actions and continuous monitoring for anomalies.
Infrastructure resilience testing
Regular resilience testing under load, failures and unusual conditions, plus server hardening, network segmentation, access management, event monitoring and anomaly detection.
Product security
Secure development (SDLC)
We build security into every stage of development, including automated code scanning and security testing tools (SAST/DAST) to find weaknesses and reduce risk.
Penetration testing
Regular penetration tests by external security firms (Red Team). Findings are reviewed and remediated immediately, including fixes and hardening as needed.
Identity management
We require SSO and multi-factor authentication (MFA) to protect user access, alongside DDoS protection and rate limiting to curb suspicious access attempts.
Organizational security
Threat intelligence & dark-web monitoring
Advanced cyber-intelligence capabilities continuously monitor external environments — forums, marketplaces and dark-web data sources — for early detection of mentions, potential leaks and exposed credentials.
Access management
Access to production systems is granted to employees strictly on a need-to-know basis, with full control over permissions, DLP (data loss prevention) systems and continuous monitoring.
Employee awareness
All employees undergo periodic security training, including awareness exercises and phishing simulations.
Employee background
Our founders and core team come from strong technology backgrounds in development and information security. Every employee undergoes rigorous screening and background checks before starting.
Responsible AI
We adopt AI responsibly and securely. It saves manual work and prevents errors, and it stays under full control and oversight.
Where AI works
Inside the product: reading invoice data from documents, matching invoices to orders and delivery notes, detecting anomalies and duplicates, and an assistant for smart search.
A person approves every financial action
AI suggests, people decide. Any action that affects an invoice or a payment is approved by an authorized user.
Under the same security controls
Our use of AI follows an internal AI-use policy and is in scope of our ISO 27001 and SOC 2 controls, like every other part of the platform.
Security questions before you start?
In a demo we’ll answer all of your organization’s security and compliance questions.