• Information Security Management System (ISMS) Policy
• Information Security Policy
• Acceptable Use Policy
• Information Security Guidelines for New Employees
• Clear Desk and Screen Policy
• Laptop and Mobile Device Use Policy
• User Access Rights Procedure
• Encryption Key Management Policy
• Secure Configuration and Asset Management
• Secure Development Framework
• Change Management and Segregation of Duties
• Vulnerability Management
• Security Risk Assessment
• Security Incident Handling
• Business Continuity Management and Critical Functions Business Continuity Plan
• Data Retention and Record Retention Policies
• Secure Removal, Disposal, and Re-Use of Media and Equipment
• HR Security Lifecycle
• Information Security in Third-Party and Outsourcing Contracts

Terra has completed a SOC 2 Type II audit, holds ISO 42001 certification for AI management systems, is a CREST-accredited member company for Vulnerability Assessment, and aligns its data handling practices with the EU General Data Protection Regulation (GDPR).

Data in transit is encrypted using TLS, and data at rest is encrypted using AES-256. Access to customer data is restricted through a centralized authentication and authorization gateway.

Terra regularly tests its own platform using its AI-driven penetration testing and red teaming methodology, with human security experts validating findings and driving remediation on a prioritized basis.

Terra's SOC 2 Type II audit and alignment with GDPR principles support Terra's privacy and legal commitments. Terra's Data Processing Addendum, which sets out its commitments for processing customer personal data, and Terra's Privacy Policy, which explains how Terra handles personal information it collects directly and how to exercise privacy rights, are both publicly available.

Terra's platform is hosted on Amazon Web Services (AWS) in the United States, using Amazon EKS and MongoDB Atlas for data storage and processing. Customers with specific data residency requirements should contact their Terra account team.

No. Under Terra's Terms and Conditions, Customer Data is never used to train Terra's or any third party's AI models. Where Terra uses third-party AI models to deliver its services, it applies industry-standard security safeguards and access controls designed to prevent unauthorized access to, or misuse or disclosure of, Customer Data, supported by ongoing testing, monitoring, and guardrails. Customers own their data, including all penetration testing reports, and Terra uses it solely to provide the services.

Terra's current subprocessors are listed in the Privacy and Subprocessors section above.