// Trust & Security Report
37signals LLC
Basecamp 5 is a cloud project management and team collaboration platform. The 37signals suite also includes HEY (email), Fizzy, Backpack, and Highrise. Basecamp is AI agent-ready with integration support for Claude, ChatGPT, and other LLM tools via CLI and API.
Certifications held
2
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on 37signals.com“GDPR compliant with Data Processing Agreement: 'We establish GDPR-compliant data processing agreements with each subprocessor.' Standard Contractual Clauses implemented for EU data transfers.”
Verify on 37signals.com“Card information is transmitted, stored, and processed securely on a PCI-Compliant network.”
> Show 6 unconfirmed / not-held certifications
source: 37signals.com37signals does not hold SOC 2 certification. The company philosophy accepts that 'Basecamp doesn't have SOC 2 compliance that enterprise security teams require,' viewing cert pursuit as 'compliance theatre' rather than essential.
source: 37signals.comNo mention of ISO 27001 certification on security or compliance pages. Not listed among certifications or compliance standards claimed by vendor.
source: 37signals.comBasecamp does not offer a Business Associate Agreement (BAA) at any plan tier. No HIPAA certification. Users should not upload protected health information.
source: 37signals.comNo public evidence of ISO 27017 certification on vendor domain.
source: 37signals.comNo public evidence of ISO 27018 certification on vendor domain.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
US (default); EU data residency available as optional feature for GDPR-compliant European storage
Basecamp lists Anthropic and OpenAI as subprocessors for 'AI assistant services.' These are integration points where users can opt-in to use external AI tools. No evidence that Basecamp itself trains ML models on customer project data. Customers control whether they share data with these third parties via optional API/agent integrations.
// Security controls
Encryption in Transit
TLS/HTTPS with modern cipher suites (AES_128_CBC, SHA2, ECDHE_RSA) and forward-secrecy key exchange
37signals.comEncryption at Rest
AES-256 encryption for stored files; Basecamp 5 includes app-level 'at-work' encryption where database content fields are encrypted with individual keys
37signals.comAccess Controls
Audited employee access to customer data; limited access only for support, error fixes, security investigations, and legal compliance
37signals.comInfrastructure
Redundant data centers with automatic failover; firewalls and 24/7 monitoring; regular encrypted backups
37signals.comUptime & Reliability
99.99% historical uptime record; current status shows 100% uptime for Basecamp 5 (past 90 days); no SLAs offered
Data Portability
Users can export and take their data at any time; cancel anytime with no lock-in
// Products & data scope
data: Projects, tasks, messages, files, documents, calendar events, comments, chat, recordings (voicenotes)
Main product. AI agent-ready with API, CLI, and Skills. Supports integration with Claude, ChatGPT, and other LLMs. Pricing: Free (1 project, 20 users), Pro ($15/user/month), Pro Unlimited ($299/month).
data: Email messages, attachments, contacts
Separate product by 37signals. Email service with focus on inbox organization and spam filtering.
data: Product data not detailed in public materials
Product mentioned on 37signals site; limited public information available.
data: Customer contacts, deals, notes, activity history
Legacy product; separate subprocessor list maintained.
data: Documents, pages, notes
Legacy product; separate subprocessor list maintained.
// What to watch
- LACKS_ENTERPRISE_CERTS: Basecamp intentionally does not pursue SOC 2 or ISO 27001 certifications, viewing them as 'compliance theatre.' This is a deliberate company choice but may disqualify Basecamp for enterprises with strict compliance mandates.
- NO_HIPAA: Basecamp does not offer BAA and is unsuitable for healthcare data. Users must not upload PHI.
- NO_SLA: 37signals explicitly does not offer service-level agreements, though uptime history is strong (99.99%).
- AI_SUBPROCESSORS: Basecamp lists Anthropic and OpenAI as subprocessors for optional 'AI assistant services.' Customers should review Anthropic and OpenAI's own terms before enabling agent integrations, as external AI vendors may process project data.
- GDPR_ONLY: Data protection certification is limited to GDPR/DPA. No other data protection certs (ISO 27701, etc.) mentioned.
// At a glance
Pricing model
Freemium with per-user (Pro) and flat-rate (Pro Unlimited) paid tiers
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on 37signals LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
37signals.com