Security Policy
This Security Policy describes the technical and organisational measures Mosaic uses to protect customer data in the hosted Mosaic platform. It is the description of security measures referenced by Mosaic's Data Processing Addendum (Annex II of the EU Standard Contractual Clauses).
5.1 Hosting and Data Location
Mosaic runs on Amazon Web Services ("AWS"), with AI and analytics services hosted on Google Cloud Platform. Customer data is stored in the United States (AWS US East) by default. Hosting in other regions may be supported where contractually agreed.
Mosaic's integrations platform uses Microsoft Azure to connect Mosaic with customers' on-premise systems. AWS, Google Cloud and Microsoft each publish SOC 2 Type II and ISO 27001 attestations through their own compliance programs. The current list of Mosaic's sub-processors and their data locations is maintained at https://trust.mosaicapp.com (see Section 5.12).
5.2 Security Operations and Monitoring
Mosaic's security team is responsible for the protection of customer data and of the operational systems that support the Mosaic platform.
Production access, administrative actions, network events and authentication events are logged centrally and monitored continuously. Threat detection across Mosaic's cloud accounts feeds a central security information and event management (SIEM) platform, and failures of critical security controls raise alerts that are triaged under Mosaic's Incident Response Plan. Systems are patched on the timelines set out in Section 5.11.
5.3 Backups
Mosaic performs automatic backups of all customer and system data every day. Backups are encrypted using the same controls applied to live production data and are monitored; a failed backup raises an incident alert. Backups are retained in accordance with Mosaic's Data Retention Policy and are purged within 180 days after an account's data is removed from the system (see Section 5.10).
5.4 Security Controls
Mosaic uses multiple layers of technical and procedural controls to protect customer data, including:
Infrastructure
- Network segmentation and VPC firewalls
- Web application firewall
- Managed threat detection across cloud accounts
- Centralized log management and SIEM
- Least-privilege identity and access management; no shared or default accounts on production systems
- Encryption in transit and at rest (Section 5.8)
Application and development
- Every code change is reviewed before release
- Automated dependency and static code scanning on every change
- External vulnerability scanning of internet-facing infrastructure
- Separate development and production environments
- Documented change management for customer-impacting changes
People
- Background checks for all employees, as permitted by law
- Security awareness training within 30 days of hire and annually thereafter
- SSO and/or multi-factor authentication on all internal systems that support it
- Managed, monitored endpoints with endpoint protection
- Regular access reviews with removal of unneeded access
For your users
- Two-factor authentication, single sign-on and role-based permissions (Section 5.7)
5.5 Independent Assurance
Mosaic completes a SOC 2 Type II examination every year through an independent CPA firm, covering a twelve-month observation period. The current SOC 2 report, Mosaic's Data Processing Addendum and Mosaic's security policies are available through https://trust.mosaicapp.com.
Mosaic processes customer data as a processor under the GDPR. Mosaic's Data Processing Addendum sets out the processor terms, sub-processor notice period and security incident notification commitments described on this page.
5.6 What You Can Do
Security is a shared responsibility. Mosaic recommends that every customer:
- Turn on two-factor authentication for all users, and single sign-on where available (Section 5.7).
- Give each person the least-privileged Mosaic role they need, and remove access promptly when people leave.
- Keep devices patched and protected with up-to-date endpoint security. Security of your devices is the responsibility of you and your IT provider.
- Report anything suspicious to support@mosaicapp.com.
If a device is lost or compromised, your data remains protected on Mosaic's servers; sign in from a new device and rotate the affected password.
5.7 Signing In
Passwords should include upper- and lower-case letters, a number and a symbol; they are never stored or transmitted in plain text.
Two-factor authentication is available to every customer. A team administrator turns it on in Team Settings → Security and can either require a specific method for all users (an authenticator app, which we recommend, or SMS) or let each user choose. Single sign-on using SAML 2.0 is configured by a team administrator in the same place, including verification of your email domain; when SSO is enabled, authentication (including any multi-factor step) is handled by your identity provider.
5.8 Data Encryption
Data in transit between your browser and Mosaic, and between Mosaic services, is protected with Transport Layer Security (TLS) 1.2 or higher. Data at rest is encrypted with AES-256. Encryption keys are held in cloud key-management services (AWS KMS, Google Cloud KMS), and are managed and rotated in accordance with Mosaic's Encryption Policy.
5.9 Service Availability and Continuity
Mosaic is designed for high availability and is deployed across multiple AWS Availability Zones by default. Live service status, incident history and 90-day uptime for every component are published at https://status.mosaicapp.com, where you can subscribe to updates by email, Slack or RSS.
Mosaic maintains Business Continuity and Disaster Recovery plans that define recovery objectives for each system component. The plans are tested at least annually. Mosaic is not responsible for delays resulting from AWS, Google Cloud or other provider downtime.
5.10 Data Retention and Deletion
Your data remains in Mosaic while your account is active. When an account is closed in good standing, its data is retained for 180 days and then permanently deleted; you can export your data at any time through the application or the Open API before then. Backups containing deleted data are purged within 180 days of deletion. The full retention terms, including accounts not in good standing, are in Section 1.6.7 of the Terms of Use.
5.11 Vulnerability Management and Responsible Disclosure
Mosaic scans continuously for vulnerable dependencies and insecure code on every change, and scans its external infrastructure at least quarterly. Findings are tracked to closure against the following timelines:
- Critical: 5 business days
- High: 30 business days
- Medium: 60 business days
- Low: 90 business days
No software is deployed to production with an unresolved Critical or High finding unless a documented, approved exception is in place.
To report a vulnerability, email security@mosaicapp.com. Mosaic acknowledges reports within 2 business days and, after triage, shares an expected remediation timeline. See Mosaic's Responsible Disclosure Policy for scope and safe-harbor terms.
5.12 Sub-processors
Mosaic uses sub-processors to deliver the service. The authoritative list, including data locations, is maintained at https://trust.mosaicapp.com.
Mosaic gives at least 14 days' notice before a new sub-processor processes customer personal data, and customers may object on reasonable data-protection grounds, as set out in the Data Processing Addendum.
Mosaic and Your Data Security Responsibilities
6.1 Authorization
If you provide Mosaic any personal or sensitive data relating to other individuals, either directly, through our websites, through our software, or otherwise, you represent that you have the authority to do so and permit us to use, access, or host that data in accordance with this policy, the Terms of Use and the Privacy Policy.
6.2 Account Access
Mosaic employs industry-standard security measures to ensure the security of information. However, the security of information transmitted through the Internet can never be guaranteed. Mosaic is not responsible for any interception or interruption of any communications through the Internet or for changes to or losses of information. Users are responsible for maintaining the security of any password, user ID, or other forms of authentication involved in obtaining access to password protected or secure areas of any Mosaic websites.
6.3 Security Incident Notification
If Mosaic confirms a security incident involving your data, Mosaic will notify your designated contact in writing without undue delay and no later than 24 hours after discovery. The notification will include, to the extent then known: the categories and approximate number of data subjects and records affected; the nature of the incident and its known or estimated time frame; the categories of data involved; the identity and contact details of Mosaic's incident representative; the likely consequences; and the measures taken or proposed to mitigate the incident, with recommended steps for you. Mosaic will provide updates as further details are validated.
To protect you and your information, Mosaic may suspend access to the service, without notice, pending an investigation, if any breach of security is suspected. Unauthorized access to password-protected or secure areas of any Mosaic website is prohibited and may lead to criminal prosecution.
If you have reason to believe that your account or our service is no longer secure, contact support@mosaicapp.com immediately. To report a suspected vulnerability, contact security@mosaicapp.com (Section 5.11).
6.4 Use of Information
How Mosaic collects, uses and discloses personal information is described in the Mosaic Privacy Policy (https://www.mosaicapp.com/privacy-policy).
Last Updated Date: 09/30/2026