Security
How we protect your agency’s data.
Caldera has completed its SOC 2 Type II audit with an unqualified opinion, and Mesa runs under the safeguards HIPAA requires. Here is how we host, protect, and govern the data you bring to it.
Compliance
SOC 2 Type II and HIPAA.
SOC 2 Type II
Advantage Partners, an independent CPA firm, examined how our security controls operated over the audit period and issued an unqualified opinion. The report is available through our trust center.
HIPAA
We maintain the administrative, physical, and technical safeguards required by the HIPAA Security Rule, and monitor them in Vanta alongside our SOC 2 controls.
Mesa is listed on the FedRAMP Marketplace in the Initial Implementation phase, and Caldera is pursuing FedRAMP 20x Class A certification for it. FedRAMP information
Practices
How we handle your data.
A summary of our main controls. Detailed policies and live control status are in the trust center.
Hosting and encryption
- Where your data lives
- Mesa runs on Google Cloud in the United States. Subprocessors that store customer data are pinned to US regions, and requests to AI models are routed only to US infrastructure.
- Encryption
- Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, including backups. Encryption keys are managed in Google Cloud KMS.
- Backups and recovery
- The primary database is backed up automatically with point-in-time recovery. We test our disaster recovery plan at least once a year.
Access
- Single sign-on
- Staff sign in through your identity provider, including Okta or any SAML or OIDC provider, so your MFA and session policies apply. SSO is included at no extra cost.
- Permissions and audit log
- Administrators decide who can see which documents and folders, by user or group, and can review activity in the organization audit log.
- Caldera staff access
- Our team can access customer data only when their role requires it, and we review that access regularly.
AI models
- No training on your data
- Your data is never used to train AI models, ours or anyone else’s. Our agreements with model providers prohibit it, and our contracts with you say so.
- Model providers
- Mesa uses models from Anthropic, OpenAI, and Google through their enterprise APIs. Our current subprocessors are listed in the trust center.
Operations
- Monitoring and incident response
- Production is monitored around the clock, and alerts page an on-call engineer. We keep a documented incident response plan and test it at least once a year.
- Secure development
- Every code change is peer reviewed and passes static analysis, dependency scanning, and secret scanning before it merges.
- Our team
- Everyone at Caldera passes a background check before joining and completes security training every year.
Common questions.
Request it through our trust center at trust.calderapbc.com. The report is shared under NDA, and the trust center handles that step. It also has our policies and the current status of our controls.
Questions from your security team?
We’re glad to walk through our controls, share the SOC 2 report, or work through your agency’s questionnaire with you.