---
title: "Security - Reflex"
---

# Deploy anywhere your security requires.

Use Reflex Cloud, your own cloud, or your own servers, including air-gapped networks. Reflex is SOC 2 compliant, and on-premises deployments can meet requirements like HIPAA.

## From managed cloud to air-gapped.

Every option runs the same Python apps. Choose the one that matches your team's security requirements.

### Reflex Cloud

Managed hosting on SOC 2 compliant infrastructure, and the fastest way to production.

### Your cloud

Deploy into your own AWS, Azure, or GCP account, inside your network and access rules.

### On-premises

Run on your own servers to meet requirements like HIPAA, with a BAA on Enterprise.

### Air-gapped

Run Reflex Build and your apps on networks with no internet access.

## Enterprise-grade security at every layer

From data protection to privacy compliance, Reflex is built with security-first principles to meet the needs of modern teams and enterprises.

### Data Protection

**Data Encryption**

AES-256 encryption at rest, TLS 1.2+ in transit.

**Database Backups**

Daily encrypted backups with 30-day retention.

**Data Segregation**

Customer data is logically isolated per tenant.

### Product Security

**Penetration Testing**

External tests conducted annually.

**Secure Development Lifecycle**

Code reviews, linting, and security scans.

**Dependency Management**

Automated scanning for vulnerabilities.

### Enterprise Security

**SSO/SAML**

Supports major identity providers for centralized auth.

**Granular Permissions**

Role-based access control across teams.

**Audit Logs**

Track every access and change in the system.

### Data Privacy

**GDPR & CCPA Ready**

Compliant data handling and user rights.

**Data Deletion Requests**

Users can request full data erasure.

**Privacy by Design**

Privacy baked into product architecture.

## Bring your requirements. Get the right details.

Discuss the applicable controls, documentation, and terms for your proposed configuration with our team.

01

### Architecture and AI data

Review application data, Builder prompts and code, company context, model providers, processing locations, and retention requirements.

02

### Access and operations

Identify identity providers, user roles, logging needs, infrastructure ownership, and the support responsibilities for your deployment.

03

### Procurement and assurance

Tell us which reports, data-processing terms, and service commitments your review requires so we can discuss the applicable material.

### Security scan

Read what the scan checks, how project code is processed, and the limitations of the review.

[Read the technical explanation](https://reflex.dev/blog/security-scan/)

### Privacy and terms

Review the published Builder privacy policy and terms of service. Discuss requirements for your enterprise agreement with our team.

[Read the privacy policy](https://build.reflex.dev/privacy-policy)