Compliance
Banana Peel is SOC 2 Type II. That is Banana Peel's certification. The report is available under NDA — contact sales.
What we do not claim
Banana Peel does not currently hold ISO 27001, HIPAA, or PCI DSS certifications. We will not put those badges on this page. If a customer needs a BAA or a DPA, contact sales— do not assume a self-serve pack exists until we send it.
Routing categories are not attestations
routing: "SOC2", "HIPAA", and "EU" select MVP runner pools. They are not a substitute for Banana Peel's SOC 2 Type II report, and they do not attest that a completed run meets HIPAA or EU residency requirements.
Subprocessors
- Infrastructure: Google Cloud (Cloud Run, Firestore, Identity Platform) in
us-central1. - Payments: Stripe. Card data does not land in Banana Peel systems.
- Runners: when custody allows a hosted runner to execute your task, that vendor is a subprocessor for that run. That is the point of custody: you choose which class of runner may see the secret. Restricted-tier runners are excluded under the default
trusted_runnerspolicy.
A current subprocessor list for a specific contract is provided on request with the DPA.