Donut

Donut hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@donut.com or via a /security page (Donut lists a security contact).

Donut lists 37 subprocessors on its trust center, including Amazon Web Services, Google Workspace, Heroku, Slack, Cloudflare. Buyers use this for fourth-party risk review.

Donut hosts on AWS. Data residency details are on its trust center.

Donut's trust center is at https://trust.donut.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We do! You can view Donut's DPA here.

*Slack Permissions* Donut uses Slack's Granular Permissions in order to request only the permissions we need to make the app function. When you install Donut on your Slack workspace Slack will present you with a list of the specific permissions that Donut requests, and you will have an opportunity to approve or reject those permissions. *Channel and Message Access* Donut's access to messages in Slack is quite limited, for two main reasons: 1. Donut only can read messages in channels or DMs where Donut is a member. 2. Donut only needs to be in the channel(s) where you want to use Donut. Consequently Donut will only be a member of channels that a user invites it to or where a user explicitly sets up Donut features. This means that Donut does not have access to anyone's private DMs (unless it's a DM with Donut), nor does Donut have access to any public or private channel content unless someone from your team has explicitly added Donut to the channel.

Donut is hosted on Heroku and AWS and benefit from their world-class security. We leverage Slack’s OAuth for signing into our website, making Donut as secure as Slack. Our website and servers use HTTPS over SSL (TLS 1.3) to protect user data. Donut is built on Ruby on Rails and benefits from the same Rails security that is trusted by industry. Donut is used by Fortune 500, FinTech, and cloud-security companies, among others.

We use Slack's OAuth authentication for signing into Donut — this is the only way to sign into our site. Therefore we indirectly support any SSO that Slack supports.

We store our application data in Heroku Postgres and benefit from their world-class safety and security, which includes encryption at rest. We use Heroku PGBackups for backing up our Postgres database.

Our bot receives messages that are sent in channels, DMs, and groups where it is a member. However the only messages that we store in our database are those that are sent in the multiparty DMs that the Donut bot creates when it pairs people up, those sent in DM with the Donut bot, and those sent in channels where Donut is explicitly set up. We store the messages from these DMs in order to collect feedback and improve the product.

For our pairing algorithm, we look at who is in which channels — we do not look at or analyze any messages (and we cannot see any messages from channels we are not in). For analytics, the only other relevant data we pay attention to is how many people are in each Slack team.