Trust Center

Welcome to the pgEdge Trust Center. This portal is designed to provide our customers, partners, and visitors with a transparent, high-level overview of our security posture, compliance frameworks, and data protection practices.

About pgEdge

pgEdge is the open source Postgres company for agentic AI and enterprise applications. We help organizations move from prototype to production on standard Postgres, combining AI tooling with the deployment flexibility, security, and reliability enterprises need.

As active members and leaders within the Postgres community, we support organizations including Bertelsmann, Qube Research & Technologies, Thales, and U.S. government agencies. Our platform is built on 100% open source, standard Postgres, giving customers control over their data and infrastructure without vendor lock-in.

Customers can deploy in pgEdge’s cloud, their own cloud, or on-premises, including air-gapped environments, backed by expert Postgres support available 24x7x365. For workloads that require it, optional active-active replication supports high availability, low latency across regions, and data residency requirements.We deliver these capabilities through two primary deployment approaches:

• pgEdge Enterprise Postgres: A self-hosted solution deployed and managed by customers on-premises or in the cloud.
• pgEdge Starfleet: A fully managed cloud service that handles the deployment and maintenance of globally distributed databases within customer-provided cloud accounts (AWS, Google Cloud, Azure).

---

Our Trust Posture & Commitments

At pgEdge, we design our systems, processes, and operational requirements to safeguard customer data and ensure the continuous availability of our services. Our core trust commitments are structured around three primary pillars:

1. Security & Data Protection

• Access Control: We enforce role-based access control systems built on the principle of least privilege. This ensures that employees and contractors are granted only the minimum level of system access necessary to perform their roles.
• Data Encryption: To protect customer information from unauthorized disclosure, we utilize industry-standard encryption technologies to secure data both at rest and in transit.
• Vulnerability & Change Management: We employ automated vulnerability scanning software to check our source code and open-source dependencies for security issues. Furthermore, we adhere to a strict Systems Development Life Cycle (SDLC) policy where development and testing environments are logically separated from production, and all production changes require documented management approval.

2. Availability & Operational Resilience

• Continuous Monitoring: We utilize system performance and availability monitoring mechanisms to ensure consistent service delivery. Critical alerts are routed to an on-call operator with a 15-minute acknowledgment SLA to ensure rapid incident response.
• Disaster Recovery: We maintain comprehensive business continuity and disaster recovery plans that define clear roles, responsibilities, Recovery Point Objectives (RPOs), and Recovery Time Objectives (RTOs).

3. Compliance & Audits

We employ dedicated Security and Compliance teams focused on monitoring and managing our alignment with industry-standard frameworks and regulatory requirements.

• SOC 2 & SOC 3: pgEdge has undergone independent examinations resulting in SOC 2 Type 2 and SOC 3 reports. These audits evaluate the suitability of the design and operating effectiveness of our controls relevant to the Trust Services Criteria for Security, Availability, and Confidentiality.
• HIPAA: We maintain security and breach protocols designed to align with HIPAA performance criteria, including the secure management of encryption keys and the protection of electronically transmitted protected health information (ePHI).
• Physical Security: pgEdge operates as a fully remote company and does not maintain physical offices. All production configuration data is hosted by trusted, world-class subservice organizations (Amazon Web Services and Vercel) that restrict physical access to their facilities.

---

Using the Trust Center

This Trust Center serves as a central repository for our security policies, compliance reports, and operational controls. We invite you to explore the dedicated sections of this portal to review our specific certifications, detailed policy documentation, and the independent audit reports that validate our ongoing commitment to security and trust.