This page is the official trust center for Marta.
Report a vulnerability Main site

Frequently asked questions

Quick answers to common security questions.

Frequently asked questions

Quick answers to common security questions.

View all
Where is customer data stored?
Production application and database infrastructure runs on Google Cloud in Belgium (europe-west1). Customer-uploaded files are stored in Cloudflare R2 with encryption at rest.
Do you encrypt data at rest and in transit?
Yes. Customer databases and object storage are encrypted at rest. All public endpoints are served over HTTPS with TLS 1.2+ via Cloudflare and Caddy.
Do you support SSO?
Google OAuth sign-in is supported today. SAML/OIDC enterprise SSO is on our roadmap for a future release.
How can I report a security issue?
Contact us at **support@trymarta.com**. We prioritize security reports and aim to acknowledge them within one business day.
Which subprocessors does Marta use?
Our primary subprocessors include Google Cloud (compute), Cloudflare (CDN, WAF, and R2 storage), Resend (email), Elastic Cloud (logging), GitHub (source control), and Google Analytics where enabled. See the Subprocessors page for details.