Matter is SOC 2 Type II certified (SOC2), signs everyone in with single sign-on (SSO) through Slack or Microsoft Teams so it never stores passwords, hosts on Amazon Web Services (AWS), and encrypts data at rest (AES-256) and in transit (TLS 1.2). It is GDPR compliant, offers a data processing agreement, and is an active participant in the Data Privacy Framework. The full documentation lives on matterapp.com; this article is the summary and the index.
Who can use this: anyone evaluating Matter or running a security or vendor review, on any plan.
For everything on this topic, see the Workspace admin collection. Related articles: Which languages does Matter support? and Vendor and remittance details for Matter.
Answers at a glance
SOC 2: Matter is SOC 2 Type I and Type II certified. The audit report is available under NDA to qualified customers; email hello@matterapp.com to request it. SOC 2
Single sign-on (SSO) and passwords: there are no Matter accounts or passwords. Members sign in through SAML based single sign-on via Slack or Microsoft Teams, and Matter never stores, uses or has access to user passwords.
Hosting: Amazon Web Services (AWS) data centers, with each service fully redundant.
Encryption: TLS 1.2 for traffic between your browser and Matter, AES-256 for data stored at rest and for database credentials. Encryption
GDPR and data processing: GDPR compliant with data portability and management tools; a data processing agreement is available. GDPR and Data processing agreement (DPA)
Data Privacy Framework: active participant, with certification documentation on the legal page. Data Privacy Framework
Security measures: technical and organisational measures covering access controls, encryption standards, vulnerability management and secure development. Security measures
Payments: handled by Stripe; Matter does not store card numbers.
W-9 and vendor details: Vendor and remittance details for Matter
Subprocessors
Matter uses a small number of subprocessors to deliver the service, for example for hosting, email delivery and reward fulfillment. The current list, with each subprocessor's purpose and location, is kept at matterapp.com/legal/sub-processors.
Privacy and data processing
Security and compliance
Have a security questionnaire or a question these pages do not cover? Email hello@matterapp.com.