# Source: https://linear.app/docs/security.md

# Security

Learn more about our data security practices and compliance measures.

![Lock icon for the security page](https://webassets.linear.app/images/ornj730p/production/0f55ef41e6ad21c246445ed595e65a966851aa51-2160x1327.png?q=95&auto=format&dpr=2)

## Overview

Linear is built with best-in-class security practices to keep your work safe and secure at every layer. This includes state-of-the-art encryption, safe and reliable infrastructure partners, and independently verified security controls.

Refer to our [Data Processing Agreement](https://linear.app/dpa) (DPA) for specific details.

## Shared responsibility

Under our shared responsibility model, Linear secures the components that we control, including the application layer, underlying platform, and cloud infrastructure. This includes protecting against threats targeting these components through security controls, monitoring, and incident response.

Customers are responsible for how they use Linear. This includes configuring workspace security and access, determining what data they store and retain, managing API keys and integrations, and monitoring their audit log.

## Certifications

Linear is compliant with GDPR, SOC 2 Type II, and HIPAA. 

For HIPAA compliance, we offer a Business Associate Agreement (BAA) to customers on [our Enterprise plan](https://linear.app/pricing). Please contact us at sales@linear.app for more information.

To request other security and compliance documents for Linear, please visit our [Trust Center](https://trust.linear.app/). If you have further questions about any of our certifications, please let us know at support@linear.app.

## Data regions

When creating a new workspace, you have the option to select the region where you want your data to be stored. The available options are:

* United States
* European Union

> [!NOTE]
> Your data region selection chosen at workspace creation is permanent, and cannot be updated at a later date.

Most of the data associated with the workspace — including issue descriptions and uploaded attachments—will only be stored in the selected region. Regardless of the region you select for your workspace, the following data is always stored in the United States:

* Information about the workspace, all user account information and user created API keys, used to authenticate users and direct them to the right region.
* Notification emails that are sent to workspace users will be stored in the U.S. for 7 days by our email sending partner.
* Usage data, used for analytical purposes.
* Workspace data and user account information used for analytical purposes. This data has been stripped of any information that might be confidential, including issue titles and descriptions, comment content, project names, team names, and document content and initiative names among others.
* User account information associated with any crashes that happen on the client or when processing a client or API request, in order to be able to debug crashes.

## Report a vulnerability

You can read more about reporting any suspected security issues, what's in scope for reports, and other guidelines on our [report a vulnerability page.](https://linear.app/security/vulnerability)

## FAQ

<details>
<summary>Is your data encrypted?</summary>
All communication outside our cloud environment is encrypted. In addition, our databases are encrypted at rest.
</details>

<details>
<summary>How can I access, transfer or delete my data?</summary>
Contact us at support@linear.app and we can help.
</details>

<details>
<summary>How to set up Linear for HIPAA compliance?</summary>
For HIPAA compliance, we offer a Business Associate Agreement (BAA) to customers on [our Enterprise plan](https://linear.app/pricing). Contact us at sales@linear.app.
</details>