Skip to main content

Security & Compliance

Toggly takes security and compliance seriously, providing enterprise-grade security features and compliance certifications.

Security Features​

Encryption​

  • In Transit: All API communication uses TLS 1.3
  • At Rest: Data encrypted using AES-256
  • API Keys: Encrypted and hashed in storage

Authentication​

  • API Keys: Secure API key authentication
  • SSO/SAML: Single sign-on for enterprise customers
  • Multi-Factor Authentication: Optional MFA for additional security
  • OAuth 2.0: Support for OAuth-based authentication
  • Token Invalidation: Immediate token revocation for secure logout

Access Control​

  • Role-Based Access Control (RBAC): Fine-grained permissions
  • BeyondAuth Integration: Advanced authorization for enterprise
  • API Key Scoping: Limit API key permissions
  • IP Allowlisting: Restrict API access by IP address

Compliance Certifications​

Toggly maintains the following certifications:

  • SOC 2 Type II: Security, availability, and confidentiality controls
  • GDPR: European data protection compliance
  • CCPA: California consumer privacy compliance
  • ISO 27001: Information security management (Enterprise plans)

Data Protection​

Data Residency​

Choose where your data is stored:

  • US Region: Data stored in US data centers
  • EU Region: Data stored in EU data centers
  • Custom Regions: Enterprise customers can request custom regions

Data Retention​

  • Feature Flag Data: Retained according to your plan
  • Metrics Data: Configurable retention periods
  • Audit Logs: Retained per plan (30 days to 7 years)
  • User Data: Deleted upon account closure

Data Processing​

  • Minimal Data Collection: Only collect necessary data
  • Data Anonymization: User data can be anonymized
  • Right to Deletion: GDPR-compliant data deletion
  • Data Portability: Export your data at any time

Enterprise Security​

Single Sign-On (SSO)​

Enterprise customers can use:

  • SAML 2.0: Standard SAML authentication
  • OpenID Connect (OIDC): OAuth-based SSO
  • Active Directory: Integration with AD
  • Custom Identity Providers: Support for custom IdPs

SCIM Provisioning​

Automated user provisioning via SCIM 2.0:

  • Automatic User Creation: Users created automatically
  • Role Assignment: Roles assigned via IdP groups
  • User Deprovisioning: Users removed when access is revoked
  • Group Sync: Group membership synchronized

Fine-Grained Permissions​

BeyondAuth integration provides:

  • Attribute-Based Access Control (ABAC): Permissions based on attributes
  • Policy-Based Access: Define access policies
  • Dynamic Permissions: Permissions that change based on context
  • Audit Trail: Complete audit log of all access decisions

API Security​

API Key Management​

  • Key Rotation: Regularly rotate API keys
  • Key Scoping: Limit API key permissions
  • Key Expiration: Set expiration dates for keys
  • Key Revocation: Instantly revoke compromised keys

Token Invalidation​

Toggly implements secure token invalidation to ensure that authentication tokens cannot be used after logout:

  • Immediate Invalidation: Tokens are blacklisted immediately upon logout
  • Server-Side Enforcement: Tokens are validated against a blacklist on every request
  • Automatic Expiry: Blacklisted tokens are automatically removed when they expire naturally
  • Chrome Extension Support: The Toggly Chrome Extension automatically invalidates tokens when you sign out

How it works:

  1. When you sign out (via the Chrome Extension or web interface), your access token is sent to the server
  2. The server computes a secure hash of the token and stores it in a high-performance cache
  3. The token remains blacklisted until its natural expiration time
  4. Any subsequent API requests with that token are rejected with a 401 Unauthorized response
  5. The blacklist entry is automatically removed when the token expires

Security benefits:

  • Protection Against Token Theft: Even if a token is stolen, it cannot be used after logout
  • Immediate Revocation: No waiting for token expiration - logout is instant
  • No Server Restart Required: Token invalidation works without restarting services
  • Privacy-Preserving: Only a hash of the token is stored, never the full token
  • Performance-Optimized: Invalidation checks use Redis for sub-millisecond lookup times
Best Practice

Always sign out from the Chrome Extension or web interface when done working. This ensures your tokens are properly invalidated and cannot be reused.

Rate Limiting​

Toggly implements rate limiting to protect the API from abuse and ensure fair usage:

  • Anonymous Endpoints: 60 requests per minute with a queue limit of 10 requests
  • Authenticated Endpoints: 200 requests per minute with a queue limit of 20 requests
  • Global Default: 100 requests per minute per client (identified by IP address or user ID)
  • Custom Limits: Enterprise customers can request higher rate limits for their use case
Rate Limit Response

When you exceed the rate limit, you'll receive a 429 Too Many Requests response. Implement exponential backoff in your application to handle rate limit responses gracefully.

Webhook Security​

  • Signature Verification: Verify webhook authenticity
  • HTTPS Only: Webhooks only sent over HTTPS
  • Retry Logic: We automatically retry failed webhooks

Security Best Practices​

1. Use Environment Variables​

Store API keys in environment variables, not in code:

# .env file
TOGGLY_API_KEY=your-secret-key

2. Rotate Keys Regularly​

Rotate API keys every 90 days or when compromised.

3. Use Least Privilege​

Grant only the minimum permissions needed for each API key.

4. Monitor Access​

Regularly review audit logs for unauthorized access.

5. Enable MFA​

Enable multi-factor authentication for all user accounts.

6. Use SSO​

Use single sign-on for enterprise accounts to centralize access control.

Incident Response​

Toggly maintains:

  • 24/7 Security Monitoring: Continuous automated security monitoring
  • Automated Controls: Automated incident detection and response controls
  • Vulnerability Disclosure: Responsible disclosure process at [email protected]
  • Security Updates: Regular security updates and patches

Compliance Reporting​

Enterprise customers receive:

  • Compliance Reports: Regular compliance status reports
  • Audit Logs: Complete audit trail for compliance
  • Data Processing Records: Records of data processing activities
  • Security Assessments: Regular security assessments

Next Steps​