Enterprise-grade by design.
Built for the security reviews your compliance team actually runs.
Visit our Trust Center (opens in a new tab)Reports available on request
Our security and compliance program
Explore our compliance status and the controls behind it.
- SOC 2 Type II
- Independently audited security controls.
- HIPAA
- Controls for protecting health information and managing business associate agreements.
- GDPR
- Privacy policies and controls for handling personal data.
- Encryption
- Data encrypted at rest and in transit.
- Access controls
- Multi-factor authentication, access reviews and audit logs.
How it’s built
- Encryption and data protection
- Data is encrypted at rest and in transit. Our Trust Center details the controls for data handling, retention and secure disposal.
- Controlled access
- Multi-factor authentication, regular access reviews and audit logs help protect access to customer data and critical systems.
- Ongoing security testing
- Our security program includes vulnerability scanning and penetration testing. Request access to the penetration test report through our Trust Center.
- AI data handling by product
- Retention depends on the product and provider settings. Our free Transaction Categorizer uses OpenAI’s standard API settings: submitted transaction details may be retained in abuse-monitoring logs for up to 30 days, with legal and safety exceptions. Billow does not save the uploaded file. See our privacy policy for the full processing and retention details.