# Security, data residency, and compliance

Genuin runs on isolated Business Accounts with role-scoped access, encrypted data at rest and in transit, regional data residency on Enterprise plans, and an audit log of every change; compliance documents are available under Settings → Trust. Reading time about 4 minutes.

## Controls available to you

- Roles and scoped roles (see [Invite your team and assign roles](https://begenuin.com/developers/get-started/any-business/invite-team-assign-roles)); two-factor enforcement; SSO for Brand Control Center (BCC) on Enterprise.
- API keys per environment with rotation and 24-hour grace (see [REST API: authentication and keys](https://begenuin.com/developers/get-started/any-business/rest-api-authentication-and-keys)).
- Domain and app allow-lists (see [Connect your website, app, and podcast feed](https://begenuin.com/developers/get-started/any-business/connect-properties)); signed webhooks (see [Webhooks and events](https://begenuin.com/developers/get-started/any-business/webhooks-and-events)).
- Audit log export.

## Data residency

US by default; EU and other regions on Enterprise agreements. Relevance dashboard reporting scope follows residency (see [Reading the Relevance dashboard](https://begenuin.com/developers/get-started/any-business/reading-the-relevance-dashboard)).

## Compliance documents

Security overview, subprocessor list, data processing addendum, and the current attestations are under Settings → Trust and attached to Enterprise agreements (see [Choose your monetization agreement](https://begenuin.com/developers/get-started/any-business/choose-monetization-agreement)).

## How it runs

The policies here are applied to every proposal made on your account and the records are kept; questions about them are answered in BCC first and by the Trust team when needed.

**Support.** Help is available 24/7 from Brand Control Center and from every page of these docs. Ask in plain language; when a person is needed, an account manager, developer, or Ops engineer joins the same thread and stays on it until it is resolved. Every Business Account owner has this on every plan (see [24/7 Octo support: how Octo brings in account managers, developers, and Ops](https://begenuin.com/developers/get-started/any-business/24-7-octo-support-how-octo-brings-in-account-managers-developers-and-ops)).

## API & SDK

Access: the calls in the table are the proposed Business Account API (see [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map)), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (`POST /proposals/{proposalId}:approve`). Live today, the server API under `/api/thirdparty` authenticates with a `gn-access-token` (see [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api)), and [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) maps what is live to what is proposed.

| Call | Purpose |
| --- | --- |
| PUT /accounts/{accountId}/privacy | Data residency, retention, consent defaults, DSAR endpoint |
| PUT /accounts/{accountId}/security | Two-factor requirement and SSO for BCC |
| GET /accounts/{accountId}/audit | Audit log of every change by user and time |

```js
// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.privacy.update(accountId, { residency: 'eu' });
await genuin.security.update(accountId, { twoFactor: 'required', sso: { … } });
await genuin.audit.list(accountId, { since });
```

Live today: [Embed the Genuin Web SDK on your website](https://begenuin.com/developers/developer-resources/sdk/how-do-you-embed-and-configure-the-genuin-web-sdk-on-your-website) · [Integrate the Genuin iOS SDK](https://begenuin.com/developers/developer-resources/sdk/developer/genuin-sdk/native-compatibility/ios/how-to-integrate-and-power-your-brand-community-in-ios-apps) · [Receive engagement events in your own analytics](https://begenuin.com/developers/developer-resources/sdk/receive-engagement-events-in-your-own-analytics) · [Add moderators to a community](https://begenuin.com/developers/developer-resources/api/assign-moderators-to-community-using-api).

SDKs: Web SDK (see [Embed the Genuin Web SDK on your website](https://begenuin.com/developers/developer-resources/sdk/how-do-you-embed-and-configure-the-genuin-web-sdk-on-your-website)), iOS SDK (see [Integrate the Genuin iOS SDK](https://begenuin.com/developers/developer-resources/sdk/developer/genuin-sdk/native-compatibility/ios/how-to-integrate-and-power-your-brand-community-in-ios-apps)), Android SDK (see [Integrate the Genuin Android SDK](https://begenuin.com/developers/developer-resources/sdk/how-to-integrate-and-power-your-brand-community-in-android-apps)), React Native (see [Integrate the Genuin SDK with React Native apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-react-native-sdk-into-your-application)), and Flutter (see [Integrate the Genuin SDK with Flutter apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-flutter-sdk-into-your-application)) render Genuin and sign members in; the Node (`@genuin/sdk`) and Python (`genuin`) server SDKs are proposed with [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map).