Security, data residency, and compliance
Genuin runs on isolated Business Accounts with role-scoped access, encrypted data at rest and in transit, regional data residency on Enterprise plans, and an audit log of every change; compliance documents are available under Settings → Trust. Reading time about 4 minutes.
Controls available to you
- Roles and scoped roles (see Invite your team and assign roles); two-factor enforcement; SSO for BCC on Enterprise.
- API keys per environment with rotation and 24-hour grace (see REST API: authentication and keys).
- Domain and app allow-lists (see Connect your website, app, and podcast feed); signed webhooks (see Webhooks and events).
- Audit log export.
Data residency
US by default; EU and other regions on Enterprise agreements. Relevance OS reporting scope follows residency (see Relevance OS: reading the analytics dashboard).
Compliance documents
Security overview, subprocessor list, data processing addendum, and the current attestations are under Settings → Trust and attached to Enterprise agreements (see Choose your monetization agreement).
How it runs
The policies here are applied to every proposal made on your account and the records are kept; questions about them are answered in BCC first and by the Trust team when needed.
Support. Help is available 24/7 from Brand Control Center and from every page of these docs. Ask in plain language; when a person is needed, an account manager, developer, or Ops engineer joins the same thread and stays on it until it is resolved. Every Business Account owner has this on every plan (see 24/7 Octo-enabled support: how Octo brings in account managers, developers, and Ops).
API & SDK
Access: the calls in the table are the proposed Business Account API (see Business Account API: provisioning, OAuth, and the resource map), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (POST /proposals/{proposalId}:approve). Live today, the server API under /api/thirdparty authenticates with a gn-access-token (see Generate an access token), and Live API today and the Business Account API roadmap maps what is live to what is proposed.
| Call | Purpose |
|---|---|
| PUT /accounts/{accountId}/privacy | Data residency, retention, consent defaults, DSAR endpoint |
| PUT /accounts/{accountId}/security | Two-factor requirement and SSO for BCC |
| GET /accounts/{accountId}/audit | Audit log of every change by user and time |
// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.privacy.update(accountId, { residency: 'eu' });
await genuin.security.update(accountId, { twoFactor: 'required', sso: { … } });
await genuin.audit.list(accountId, { since });Live today: Embed the Genuin Web SDK on your website · Integrate the Genuin iOS SDK · Receive engagement events in your own analytics · Add moderators to a community.
SDKs: Web SDK 2.0.6 (see Embed the Genuin Web SDK on your website), iOS SDK 2.1.5 (see Integrate the Genuin iOS SDK), Android SDK 2.1.5 (see Integrate the Genuin Android SDK), React Native 3.0.3 (see Integrate the Genuin SDK with React Native apps), and Flutter (see Integrate the Genuin SDK with Flutter apps) render Genuin and sign members in; the Node (@genuin/sdk) and Python (genuin) server SDKs are proposed with Business Account API: provisioning, OAuth, and the resource map.
