Everything Sledge does to protect your data

Every byte you store in Sledge is encrypted the moment it lands and stays encrypted at rest. Production runs inside private networks with no direct public access, in established enterprise cloud data centers.

• Keys managed by a dedicated key-management service with rotation
• Encrypted, geographically redundant backups
• Hardened, regularly patched server images
• Infrastructure-as-code with peer-reviewed changes
• Segregated staging and production environments
• DDoS mitigation and WAF at the network edge

Your data is yours. Sledge never sells it and never uses it to train third-party AI models. You decide how long it is kept and can export or delete it on request, in line with GDPR and CCPA.

• Data Processing Addendum available on request
• Documented data retention schedule
• Right to access, export and erasure honored
• Data minimization — we collect only what we need
• Privacy reviews for new features

Payments are processed by a specialist payment provider. Your full card number never touches Sledge servers — we only ever see a secure token, so there is nothing sensitive for us to lose.

• 3-D Secure and strong customer authentication
• Tokenized cards stored in the processor vault, not Sledge
• Real-time fraud and anomaly monitoring

Sign-in is handled by a managed identity platform with enterprise SSO, SAML and enforced multi-factor authentication. Every session, device and admin action is logged so you always know who did what.

• SCIM provisioning and de-provisioning
• Role-based access control with granular permissions
• Configurable session timeouts
• Full authentication audit trail

Security is built into how we ship. Sledge has completed a CASA Tier 2 assessment against the OWASP ASVS, runs annual third-party penetration tests, and scans every code change and dependency before it reaches production.

• Mandatory peer review on all code
• Automated static and dependency scanning in CI/CD
• Secrets scanning to prevent leaked credentials
• Responsible disclosure program
• Remediation SLAs by severity

We watch our systems around the clock. Centralized logs feed automated detection and alerting, and a documented, regularly tested incident response plan means we react fast when something looks off.

• On-call rotation with defined escalation paths
• Point-in-time recovery and tested restores
• Post-incident reviews with corrective actions
• Uptime and status published publicly
• Anomaly detection on access patterns

Sledge runs across multiple availability zones, so a single failure does not take your jobs offline. Backups run daily with point-in-time recovery, uptime is published, and the continuity and recovery plans are tested rather than filed away.

• Tested restores, not just scheduled backups
• Documented recovery time and recovery point objectives
• Live status page for incidents and maintenance
• Redundant, geographically separated storage

Sledge uses AI to remove busywork, not to expose your data. Your information is never used to train third-party models, AI access is scoped to the minimum needed, and consequential actions stay under human review.

• AI subprocessors bound by the same data terms
• No training on customer data, contractually enforced
• Audit trail on AI-assisted actions
• Clear indication when AI is involved

People and process are part of security too. Sledge runs background checks on personnel, requires annual security and privacy training, enforces MFA on internal systems, and reviews every vendor before onboarding.

• Least-privilege internal access, reviewed regularly
• Formal onboarding and offboarding procedures
• Written security policies reviewed annually
• Confidentiality obligations for all staff