At a glance
- Hosted in the United States (US East)
- AES-256 encryption at rest, TLS 1.2+ in transit
- SSO (SAML and OIDC) and role-based access
- Third-party penetration tests and routine internal security testing
- Card payments processed by Stripe, a PCI DSS Level 1 certified provider. Card data never touches Boomerang's systems
- Working toward SOC 2 Type II, and toward GDPR compliance (EU and UK GDPR), with Drata
Data hosting and residency
Boomerang runs on established cloud infrastructure in the United States, in the US East region. Customer data is stored and processed in US data centers, and our infrastructure providers maintain their own independent security certifications. For enterprise customers with specific hosting or residency requirements, we are happy to discuss custom hosting options.
Encryption
- At rest. Databases, data stores and backups are encrypted with AES-256.
- In transit. All traffic between browsers, our apps and our services is encrypted with TLS 1.2 or higher. Connections never fall back to unencrypted channels.
- Keys and secrets. Encryption keys are managed in a dedicated key management system and rotated on a regular schedule. Credentials are never stored in code.
- Passwords. Stored only as salted one-way hashes.
Access control
For your team
- Single sign-on with SAML and OIDC, including Microsoft, Google, Okta and other major providers. When SSO is on, your identity provider's policies, such as MFA, apply to Boomerang too.
- Role-based access: admin plus custom roles, each with its own permissions, and access that can be limited by location or venue.
- Configurable idle session timeouts.
- Every change to an item or claim is recorded in its activity history.
Inside Boomerang
- Least-privilege, role-based access. Staff get only the access their role requires.
- Production access is limited to a small set of authorized engineers and protected with multi-factor authentication.
- Access is logged and reviewed at least once a year, and removed promptly when someone changes roles or leaves.
- Each customer's data is logically separated, and every request is scoped to that customer's account.
Application security and testing
- Testing. Routine internal and external security testing.
- Secure development. Every code change is peer reviewed before release, production branches are protected, and we follow OWASP secure coding practices.
- Automated scanning. Static analysis, dynamic scanning and dependency monitoring catch known vulnerabilities, which we fix on defined timelines based on severity.
- Perimeter protection. A web application firewall and DDoS protection sit in front of the platform.
- Monitoring. Systems are monitored continuously, with alerts routed to the engineering team.
Payments
When a guest pays to have an item shipped, the card payment is processed by Stripe, a PCI DSS Level 1 certified provider. Card data never touches Boomerang's systems. Boomerang does not store, process or transmit card data.
Compliance
- SOC 2. Boomerang is not yet SOC 2 certified. We work with Drata, a security and compliance automation platform, and hold a letter of assertion from Drata confirming our active work toward a SOC 2 Type II examination. Drata continuously monitors our security controls.
- GDPR. Through the same program, we are working toward GDPR compliance (EU and UK GDPR).
- Policies. We maintain a documented security program covering access control, encryption, incident response, business continuity, disaster recovery, vendor management, vulnerability management and more.
- ISO 27001. Boomerang does not hold ISO 27001 certification.
Privacy and data retention
- Minimal collection. We collect what is needed to reunite guests with their items: name, email and phone. A mailing address is collected only when a guest chooses shipping.
- Private by default. Inventory and item photos are never published as a public gallery. Item details are shown only to authorized venue staff and to the guest who filed the matching claim.
- AI features. Customer data is never used to train AI models, and all AI features and prompts are scoped to only the information and access level they need, with additional evaluations in place.
- Retention. Customer data is kept while your account is active. When an account closes, we delete your data or return it to you, whichever you prefer, and issue a certificate of deletion.
- Guest requests. Guests can ask us to delete their data at any time.
- Backups and recovery. Backups are automated, encrypted and restore-tested, and our disaster recovery plan is tested at least annually.
Our privacy policy and data processing agreement have the full legal terms.
Vendors and subprocessors
We use a small set of vetted subprocessors for services such as cloud hosting, content delivery and security, payments (Stripe), shipping, messaging and monitoring. Each is assessed for security before onboarding and reviewed periodically, and each gets only the data it needs to do its job. A current subprocessor list is available on request.
Incident response
We maintain a documented incident response plan covering detection, escalation, containment, resolution and root-cause review, and we test it at least annually. If an incident affects your data, we notify you promptly and keep you updated until it is resolved.
Vendor reviews
Running a vendor review? Book a demo and we can discuss sharing our security materials and filling out any security or vendor forms.
Questions
Is Boomerang SOC 2 certified?
Not yet. We are working toward SOC 2 Type II with Drata and hold a letter of assertion from Drata confirming that work.
Is Boomerang ISO 27001 certified?
No. Our security program is built on documented policies, continuous monitoring through Drata, and regular testing.
Is Boomerang PCI compliant?
Card payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card data never touches Boomerang's systems, so Boomerang does not store, process or transmit cardholder data.
Where is our data hosted?
In the United States, in the US East region. Enterprise customers can talk to us about custom hosting.
Do you do penetration testing?
Yes. Third-party penetration tests and routine internal security testing.
Is our data encrypted?
Yes. AES-256 at rest and TLS 1.2 or higher in transit.
Do you support SSO and MFA?
Yes. SAML and OIDC are both supported. With SSO on, your identity provider's MFA and sign-in policies apply to Boomerang.
Do you use our data to train AI?
No. Customer data is never used to train AI models, and all AI features and prompts are scoped to only the information and access level they need, with additional evaluations in place.
Can you complete our security questionnaire?
Yes. Book a demo and we can.