Your data is yours

We collect only what we need to run the products, we never sell it, and we don’t train AI on it. The details, in writing:

• Privacy Policy. What we collect, why, how we handle it, and your rights.
• Artificial intelligence. No built-in AI features that process your content, no training on it, and the AI tools we use internally are held to the same subprocessor terms as everyone else.
• Data Processing Addendum (DPA). Our GDPR and UK GDPR terms, Standard Contractual Clauses included. It’s incorporated into our Terms of Service, so it applies whenever GDPR does, with no separate signature needed. Also available as a PDF or Markdown.
• FERPA (US Schools). How our DPA supports a school designating us a school official under FERPA.
• California Notice at Collection. The additional disclosures California law asks for.
• Subprocessors. The companies that help us run each product: Basecamp, HEY, Highrise, Campfire, and Backpack, plus the Company Processors that help us run the company.

How we keep it safe

We run Basecamp and HEY on our own hardware, on the Ruby on Rails framework we created, with a team that has been doing this for over two decades. Here’s how that works in practice, and what to do if you find something we missed:

• Security Overview. Encryption, redundancy, physical security, monitoring, and a longer overview (PDF) when you need the detail.
• Security Response. How to report a vulnerability or an incident, and exactly what happens after you do.
• Bug bounty on HackerOne. We pay researchers to find what we missed, and credit them when they do.
• 37status. Uptime, live and historical, for our products.

Questionnaires and audits

We don’t hold a SOC 2 report or an ISO 27001 certificate, and we won’t pretend otherwise. What we do instead is answer the questions those audits ask, in public, in full, with gaps stated plainly, so you can judge the substance instead of a badge.

• CSA Consensus Assessments Initiative Questionnaire (CAIQ) v4.1. All 283 questions of the Cloud Controls Matrix, answered as a self-assessment for Basecamp and HEY. Also as a PDF.
• EDUCAUSE Higher Education Community Vendor Assessment Toolkit (HECVAT) 4. All 331 questions of the HECVAT 4 Full workbook, answered as a self-assessment for Basecamp. Also as a PDF, a CSV, and the filled official workbook.
• PCI DSS Certificate of Compliance (PDF). Issued by SecurityMetrics on our Self-Assessment Questionnaire A (SAQ A) v4.0.1, compliant as of June 18, 2026, and renewed annually. SAQ A applies because card numbers go straight to our payment processor and never touch our servers.
• Accessibility Conformance Report (VPAT). How Basecamp measures against WCAG 2.0 and 2.1 AA, Section 508, and EN 301 549, based on our own testing. Also as a PDF.

The terms

• Terms of Service. What you agree to when you use our products, in plain language.
• Until the End of the Internet. Our promise to keep every product running for as long as there are customers using it.
• All policies. Cancellation, refunds, ownership, taxes, and the rest. Sign up for the policy updates mailing list and we’ll tell you when they change in a significant way.

One thing you don’t need to request: a signed DPA. The DPA is part of our privacy policy and applies automatically.

Need something that isn’t here, like a questionnaire in your format or an answer these pages don’t give? Email our support team and they’ll route your question to the right people. A person will reply.