Trust center
How Mama earns the access it asks for.
One page that links to everything an evaluator (security, legal, procurement, IT) typically needs to clear Mama for use. We treat this as the source of truth — if a sales conversation contradicts this page, this page is right.
Security posture
/security →
Encryption, access control, vulnerability process, SOC 2 trajectory, pentest cadence.
Privacy
/legal/privacy →
What we collect, why, retention, your rights, GDPR + CCPA posture.
DPA
/legal/dpa →
Standard Data Processing Addendum. Sub-processors list, SCCs for EU transfers.
Terms
/legal/terms →
Acceptable use, SLA, account + payment terms.
Data sources
/sources →
Every upstream source we use, what it provides, refresh cadence, provenance.
Status + uptime
/status →
Live uptime, current incidents, RSS feed, Slack notifications.
Common evaluator questions, answered in one place.
Where is data stored?
Customer data lives in AWS us-east-1 by default. EU customers can request EU-region storage via DPA addendum — provisioning is manual today, ~5 business days.
Is Mama SOC 2 certified?
Type I audit in progress; Type II expected H2 2026. Penetration test cadence: annual external pentest + quarterly internal. Reports available under NDA.
Who can sign a custom DPA?
Pro plan and above. Email [email protected] with your draft and a short context note; turnaround is usually 3 business days.
How do I report a security issue?
Email [email protected] with details. We respond within 24h. Disclosure policy on the security page.