Replit infrastructure
SOC 2 Type 2Anthoam runs on Replit, which reports a SOC 2 Type 2 Attestation of Compliance.
Replit uses Google Cloud infrastructure, which maintains ISO 27001 and SOC 2 Type 2 certifications.
Read Replit's security overviewReport a security concern Security
Security built into every layer.
Server-enforced controls, trusted infrastructure, and secure payment handling.
Security posture
Trusted providers. Clear boundaries.
Established infrastructure and payment partners, plus server-enforced product controls.
Stripe payments
PCI DSS Level 1Stripe is a PCI DSS Level 1 Service Provider.
Card entry stays in Stripe components; Anthoam does not store full payment-card numbers.
Read Stripe's security overviewApplication safeguards
Controls that enforce the boundary.
Identity and sessions
Sign-in and sessions
Sessions rotate after sign-in and use Secure, HttpOnly cookies in production.
Access control
Organization and role access
The server checks active role assignments before guarded requests proceed.
File security
File upload boundaries
Uploads use short-lived, single-use authorization tied to the actor, organization, and purpose.
Request protection
Request and browser protections
State-changing requests use CSRF protection and production sends browser-security headers.
Payment integration
Payment boundaries
Payment-card entry stays in Stripe components; Anthoam does not store full card numbers.
Monitoring and audit
Monitoring and audit records
Production error context is sanitized, and relevant changes create scoped audit records.
Security in delivery
How we ship safely.
High-risk review
Access, payment, upload, webhook, and sensitive-data changes receive defined review.
Automated checks
Tests plus dependency, dataflow, and secret-exposure scans.
Release evidence
Security releases record validation and post-deploy checks.
Security reporting
Report a security concern.
Use the security topic on our contact form. Do not include passwords, sensitive account details, or exploit details in your first message.
Provider certifications belong to those providers; they do not certify Anthoam. No security control can guarantee absolute security. Anthoam does not claim 24/7 monitoring, independent certification, or guaranteed response times.
Public control summary reviewed August 21, 2026.