Security / trust page — Whimsical

Cited by

Facts read from this source

• SAML idp integrations Report an error

  “This means that you can set up integrations with systems like: Okta OneLogin GSuite and any other service supporting SAML 2.0 authentication”

• Aws Report an error

  “Whimsical uses Amazon Web Services (AWS) as our cloud hosting provider.”

• Encryption Report an error

  “in transit, using strong encryption (at least TLS 1.2) at rest, using AES-256 encryption”

• Integrity backups Report an error

  “Whimsical stores all data on redundant systems to help prevent data loss. Data are also automatically backed up on AWS servers with the capability to provide point-in-time recovery down to the second.”

• Backup location encryption Report an error

  “Whimsical's production data is also regularly backed up to a separate location and all backups are encrypted.”

• Monitoring 24 7 Report an error

  “These alerts are monitored 24/7 by our engineering team.”

• SOC 2 type ii Report an error

  “We are SOC2 Type II compliant, certifying that our security policies and controls continuously meet the highest industry standards.”

• Penetration testing Report an error

  “We also contract reputable, independent, third-party security firms to conduct penetration testing at least once a year.”

• Stripe payments Report an error

  “We use Stripe to accept and process credit card payments. We implement these payment technologies in a such way that Whimsical doesn't store or process any credit-card information.”

• Least privilege access Report an error

  “We operate on the principle of least-required privilege and try to provide our employees only the minimum needed permissions to the production systems and data.”

• Bug bounty Report an error

  “At the moment, we do not offer bug bounties, but we do guarantee plenty of good karma.”

• Immutable infrastructure Report an error

  “We practice immutable infrastructure, where we don't make changes to live code or running servers in production.”

• Page last reviewed Report an error

  “Last reviewed: June 26th, 2023”

• Entity Report an error

  “© 2026 Whimsical, Inc.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Microsoft 365 Admin Security, AI controls & deployment
• The Product Team Lead Security, AI controls & deployment
• The Product Team Lead European sovereignty
• The Public-Sector Project Lead Security, AI controls & deployment
• The Public-Sector Project Lead European sovereignty
• The Skeptic Security, AI controls & deployment
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Workshop Facilitator Security, AI controls & deployment
• The Workshop Facilitator European sovereignty