Modo Labs

Documents on the trust centre

What the vendor lists, typed; public items can be read now, the rest are available on request.

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

• Where data is hosted or processed

  Where do you host your services?

  “We use Amazon Web Services (AWS) as our cloud computing, storage and networking provider. Other relevant service providers include MongoDB. We provision our MongoDB Atlas database clusters on AWS.”

  as of 21 Sep 2026Source

• Encryption

  Do you encrypt data at rest? And in transit?

  “Yes. Data at rest on servers is protected by AES-256 encryption on-disk. Data in transit is encrypted using TLSv1.2 with strong cipher suites, and backwards compatibility is turned off by default.”

  as of 21 Sep 2026Source

• Encryption

  Do you support BYOK? Or dedicated encryption keys?

  “Yes, we support both. Either model is compatible with our Premium Hosting that uses dedicated application servers and databases. BYOK requires delegation of your own AWS Key Management Service (KMS) encryption key to us for use with your application. Alternatively, we can create a dedicated encryption key in our AWS KMS. In the case of dedicated keys, we will perform key operations such as rollovers by request on...”

  as of 21 Sep 2026Source

• Penetration testing

  Do you conduct penetration testing? What is your approach?

  “At least annually, we hire a third-party for penetration testing of assets including the platform and representative mobile apps (iOS and Android). We encourage you to organize your own penetration tests for apps built on Modo's platform. When you share the results, we take the opportunity to triage and validate findings, explain mitigating controls and false positives, and form mutually agreed upon plans. This fe...”

  as of 21 Sep 2026Source