Security at Chamber
Last updated: February 7, 2026
Protecting customer data is foundational to everything we build. Chamber implements comprehensive security controls across infrastructure, application, and organizational layers — validated through continuous monitoring and independent audits.
Compliance & Certifications
Chamber maintains rigorous compliance standards validated by independent third-party audits.
SOC 2 Type II
Chamber is pursuing SOC 2 Type II certification, with continuous monitoring of security controls through Vanta.
Continuous Monitoring
Automated compliance monitoring ensures all security controls remain operational and effective around the clock.
Data Protection
Customer data is protected with industry-standard encryption at every layer.
Encryption in Transit
All data in transit is encrypted using TLS 1.2+ enforced across all API and application endpoints.
Encryption at Rest
All data at rest is encrypted using AES-256, including databases, object storage, and backups.
Cross-Region Replication
Critical data is replicated across geographic regions for disaster recovery and business continuity.
Key Management
Encryption keys are managed through AWS Key Management Service (KMS), with AWS-managed keys providing automatic rotation and access controls.
Infrastructure Security
Chamber's infrastructure is built on AWS with defense-in-depth security controls.
Threat Detection
Continuous threat detection monitors for anomalous behavior, unauthorized access, and potential compromises across all environments.
Network Monitoring
Network flow logs capture traffic metadata across all environments for security analysis and incident investigation.
Audit Logging
Comprehensive API audit trails are maintained with multi-year retention, including lifecycle policies for cost-efficient long-term storage.
Infrastructure Monitoring
Proactive monitoring with automated alerts for database capacity, service health, and error rates ensures rapid incident detection.
Automated Alerting
Security findings trigger real-time notifications to the engineering team for immediate triage and response.
Access Control
Strict access controls ensure only authorized users can access resources.
Role-Based Access Control
Fine-grained RBAC with organization, admin, and member roles. Permissions are scoped to the minimum required for each function.
Single Sign-On (SSO)
Support for Google and GitHub SSO alongside email/password authentication, with secure session management and automatic token refresh.
Least Privilege
Infrastructure access follows the principle of least privilege. Service-to-service communication uses scoped IAM roles with no shared credentials.
Product Security
Security is built into every stage of the development lifecycle.
Secure Development
All code changes require peer review through pull requests. CI pipelines enforce automated testing and linting before code can be merged.
CI/CD Pipeline
Automated build, test, and deployment pipeline with separate dev, staging, and production environments and manual promotion gates.
Infrastructure as Code
All infrastructure is defined as code, version-controlled, and deployed through automated pipelines — eliminating manual configuration drift.
Incident Response
Chamber maintains a documented incident response process to quickly detect, contain, and resolve security events.
Detection & Alerting
Multi-layered detection with automated threat monitoring, network analysis, and anomaly detection feeds into a centralized alerting system.
Response Process
Documented incident response procedures cover identification, containment, eradication, recovery, and post-incident review.
Customer Notification
Affected customers are notified promptly in the event of a security incident that impacts their data, in accordance with applicable regulations.
Data Privacy
Chamber is committed to protecting user privacy and meeting regulatory requirements.
Privacy Policy
Our privacy policy details what data we collect, how it's used, and your rights. We do not sell personal data.
Data Retention
Data retention policies ensure information is kept only as long as necessary, with secure deletion when no longer required.
Read our full Privacy Policy for complete details.
Report a Vulnerability
If you believe you have found a security vulnerability in Chamber, please report it responsibly to security@usechamber.com. We take all reports seriously and will respond promptly.