Everything connects. Nothing is exposed.
Decla automates your back office without cutting corners on how your data is handled.
Reviewed and trusted by:
Our commitment to data privacy and security is built into every part of how Decla works.
SOC 2 TYPE II
An independent audit of Decla's security controls and practices.
HIPAA COMPLIANT
The federal standard for protecting sensitive health information.
Secure by design. Safe by default.
Access to your data is tightly monitored and controlled, with single sign-on available for enterprise teams.
Role-based access
Continuous monitoring
Single sign-on
Gain Access
Every vendor we work with is disclosed and available for review, updated as our subprocessor list changes.
Various subprocessors
DPA available
Vercel
Web hosting
Google Cloud
AI-Powered product features
AWS
AI-Powered product features
Supabase
Database and authentication
Resend
Transactional email
Vercel
Web hosting
Google Cloud
AI-Powered product features
AWS
AI-Powered product features
Supabase
Database and authentication
Resend
Transactional email
Vercel
Web hosting
Google Cloud
AI-Powered product features
AWS
AI-Powered product features
Supabase
Database and authentication
Resend
Transactional email
A dedicated team detects, responds to, and resolves security incidents, notifying affected customers within 72 hours of a confirmed breach.
Detect
Respond
Resolve
All employees complete security awareness training, refreshed on an ongoing basis to stay current and reduce risk.
Company-wide
Recurring
All AI processing runs through zero-data- retention infrastructure, so no customer data is ever used to train AI models.
Zero data retention
No mode training on customer data
US-based AI infrastructure only
Model training: blocked
Every discipline, one standard.
01
Data privacy
Follows industry best practices and applicable privacy regulations.
02
Data security
Industry best practices guide how data is secured.
03
Infrastructure
Built on best-in-class providers for secure computing and storage.
04
Network security
Corporate network protected against external and internal threats.
05
Endpoint security
Industry best practices followed to secure every endpoint.
06
Continuous monitoring
Systems continuously monitored for threats and vulnerabilities.
07
Physical & environment
Physical and environmental controls keep data centers secure.
08
Risk management
A dedicated team manages security risk company-wide.
09
Asset management
Strict policies ensure every asset is accounted for.
10
BC/DR
A business continuity plan keeps operations running through disruption.
11
Change management
Changes go through formal review and approval.
12
Corporate security
Internal measures maintain a high standard company-wide.
13
Reports
Security-related reports available on request.
Common Questions
Yes. Data is encrypted in transit and at rest using TLS 1.2+ and AES-256 encryption.
Yes. Decla completed SOC 2 Type 2 certification in April 2026, and is HIPAA compliant. A signed Business Associate Agreement (BAA) is available on Plus and Enterprise plans.
Access to your data is role-based, with multi-factor authentication required for our internal systems.
All data is processed and stored on US-based infrastructure. A full list of subprocessors is available through our Trust Center.
Active account data is kept for the length of our relationship plus 60 days after account closure. Trial data is deleted 30 days after the trial ends. You can request earlier deletion at any time.
Yes. A DPA is available and can be requested through our Trust Center or your Decla contact.
Decla has a dedicated team that responds to security incidents, and will notify affected customers and applicable regulators within 72 hours of confirming a breach.
Security-related reports and completed security questionnaires are available upon request through our Trust Center or your Decla contact.
