Security and privacy at Modal changed Modal, Oct 12, 2026

1. +Added: This page outlines Modal's security and privacy commitments.
2. +Added: Our Trust Center provides compliance documentation, including our SOC 2 Type II report, our list of subprocessors, and details of our security controls.
3. +Added: Our information security (InfoSec) program covers three practice areas: application security, corporate security, and network and infrastructure security.
4. +Added: AppSec covers how we build, test, review, and deploy the Modal platform.
5. -Removed: The document outlines Modal's security and privacy commitments.
6. -Removed: AppSec is the practice of building software that is secure by design, secured during development, secured with testing and review, and deployed securely.
7. +Added: Software dependencies are automatically audited for known vulnerabilities.
8. -Removed: Software dependencies are audited by Github's Dependabot.
9. +Added: We force HTTPS (TLS) for all services, including our public website and the Dashboard. Our client library connects to Modal's servers over TLS and verifies TLS certificates on each connection.
10. +Added: Your data is encrypted in transit and at rest.
11. +Added: All public Modal APIs use TLS 1.3 .
12. +Added: Internal code reviews are performed using a PR-based development workflow, and we engage external penetration testing firms to assess our software security.
13. +Added: CorpSec covers how our employees access internal systems.
14. +Added: Access to internal systems requires single sign-on (SSO) through our identity provider.
15. +Added: Phishing-resistant multi-factor authentication (MFA) is required for all employee accounts.
16. -Removed: We use HTTPS for secure connections. Modal forces HTTPS for all services using TLS (SSL), including our public website and the Dashboard to ensure secure connections. Modal's client library connects to Modal's servers over TLS and verify TLS certificates on each connection.
17. -Removed: All user data is encrypted in transit and at rest.
18. -Removed: All public Modal APIs use TLS 1.3 , the latest and safest version of the TLS protocol.
19. -Removed: Internal code reviews are performed using a modern, PR-based development workflow (Github), and engage external penetration testing firms to assess our software security.
20. -Removed: CorpSec is the practice of making sure Modal employees have secure access to Modal company infrastructure, and also that exposed channels to Modal are secured. CorpSec controls are the primary concern of standards such as SOC2.
21. -Removed: Access to our services and applications is gated on a SSO Identity Provider (IdP).
22. -Removed: We mandate phishing-resistant multi-factor authentication (MFA) in all enrolled IdP accounts.
23. +Added: Employee laptops are enrolled in mobile device management (MDM) with full disk encryption enforced.
24. +Added: InfraSec covers how we secure the infrastructure that runs your workloads.
25. +Added: We continuously monitor platform logs and metrics through third-party observability providers.
26. +Added: Each container runs in its own sandbox, isolated from the host, using primitives like gVisor or microVMs.
27. +Added: We run business continuity and security incident exercises every year.
28. +Added: We remediate vulnerabilities in Modal's systems within the timeframes below, measured from when a fix becomes available. Severity is based on the CVSS rating of the vulnerability and our assessment of its impact on Modal.
29. +Added: We welcome responsible disclosure from the security community and run a private bug bounty program through HackerOne. To participate, email security@modal.com with your HackerOne username and we will send an invite. When performing security research, you must use a Modal Workspace whose name ends in -H1-<username> , where <username> is your HackerOne username.
30. +Added: This section covers how long each type of data is kept, which products retain no data at all, and where your data is stored.
31. +Added: Retention varies by product; the table below shows how long each type of data is retained. All stored data is encrypted at rest.
32. -Removed: Employee laptops are protected by full disk encryption using FileVault2, and managed by Secureframe MDM.
33. -Removed: InfraSec is the practice of ensuring a hardened, minimal attack surface for components we deploy on our network.
34. -Removed: Modal uses logging and metrics observability providers, including Datadog and Sentry.io.
35. -Removed: Compute jobs at Modal are containerized and virtualized using gVisor , the sandboxing technology developed at Google and used in their Google Cloud Run and Google Kubernetes Engine cloud services. Sandboxes may also run on Modal's secure VM runtime .
36. -Removed: We conduct annual business continuity and security incident exercises.
37. -Removed: Security vulnerabilities directly affecting Modal's systems and services will be patched or otherwise remediated within a timeframe appropriate for the severity of the vulnerability, subject to the public availability of a patch or other remediation mechanisms.
38. -Removed: If there is a CVSS severity rating accompanying a vulnerability disclosure, we rely on that as a starting point, but may upgrade or downgrade the severity using our best judgement.
39. -Removed: Modal prioritizes the integrity, security, and availability of customer data. Under our shared responsibility model, customers also have certain responsibilities regarding data backup, recovery, and availability.
40. -Removed: Data backup : Customers are responsible for maintaining backups of their data. Performing daily backups is recommended. Customers must routinely verify the integrity of their backups.
41. -Removed: Data recovery : Customers should maintain a comprehensive data recovery plan that includes detailed procedures for data restoration in the event of data loss, corruption, or system failure. Customers must routinely test their recovery process.
42. -Removed: Availability : While Modal is committed to high service availability, customers must implement contingency measures to maintain business continuity during service interruptions. Customers are also responsible for the reliability of their own IT infrastructure.
43. -Removed: Security measures : Customers must implement appropriate security measures, such as encryption and access controls, to protect their data throughout the backup, storage, and recovery processes. These processes must comply with all relevant laws and regulations.
44. -Removed: We have successfully completed a System and Organization Controls (SOC) 2 Type 2 audit . Go to our Security Portal to request access to the report.
45. -Removed: HIPAA, which stands for the Health Insurance Portability and Accountability Act, establishes a set of standards that protect health information, including individuals' medical records and other individually identifiable health information. HIPAA guidelines apply to both covered entities and business associates-of which Modal is the latter if you are processing PHI on Modal.
46. -Removed: Modal's services can be used in a HIPAA compliant manner. It is important to note that unlike other security standards, there is no officially recognized certification process for HIPAA compliance. Instead, we demonstrate our compliance with regulations such as HIPAA via the practices outlined in this doc, our technical and operational security measures, and through official audits for standards compliance such as SOC 2 certification.
47. -Removed: To use Modal services for HIPAA-compliant workloads, a Business Associate Agreement (BAA) should be established with us prior to submission of any PHI. This is available on our Enterprise plan. Contact us at security@modal.com to get started. At the moment, Volumes v1 , Images (excluding Filesystem and Directory Snapshots ), Memory Snapshots , and user code are out of scope of the commitments within our BAA, so PHI should not be used in those areas of the product.
48. -Removed: Payment Card Industry Data Security Standard (PCI) is a standard that defines the security and privacy requirements for payment card processing.
49. -Removed: Modal uses Stripe to securely process transactions and trusts their commitment to best-in-class security. We do not store personal credit card information for any of our customers. Stripe is certified as "PCI Service Provider Level 1", which is the highest level of certification in the payments industry.
50. -Removed: Keeping user data secure is a top priority at Modal. We welcome contributions from the security community to identify vulnerabilities in our product and disclose them to us in a responsible manner. We currently run a private bug bounty program through HackerOne. If you have found a vulnerability and wish to participate, please send an email to security@modal.com with your HackerOne username or email and we will invite you to the program.
51. -Removed: Modal will never access or use:
52. -Removed: the inputs (function arguments) or outputs (function return values) to your Modal Functions.
53. -Removed: any data you store in Modal, such as in Images or Volumes.
54. -Removed: App logs and metadata are stored on Modal. Modal will not access this data unless permission is granted by the user to help with troubleshooting.
55. -Removed: Different Modal products have different retention policies for the data they handle. The table below summarizes how long each type of data is retained.
56. +Added: While we store app logs and metadata as part of operating the platform, we access them only with your permission, to help troubleshoot an issue.
57. +Added: Dedicated and Shared inference endpoints have zero data retention. Request and response payloads are never written to disk and pass through Modal only as in-flight network traffic.
58. +Added: See our data residency guide for where each type of data is stored and the controls available for residency requirements.
59. +Added: Modal prioritizes the integrity, security, and availability of customer data. Under our shared responsibility model, you also have responsibilities in the areas below.
60. +Added: Provides access controls, including SSO, SCIM, API tokens, and RBAC, and Secrets management for storing credentials.

21 more changed paragraphs are on the page itself.