Hosting & residency
Runs entirely on AWS in Sydney (ap-southeast-2). One small Lambda + DynamoDB; no always-on servers, no admin console. Workspace data stays in-region.
Confetti — Security summary
Confetti by TinyPoll · Slack birthdays & work anniversaries · payments via Stripe as TinyPoll
Updated 23 July 2026
confetti.tinypoll.io/security.html
confetti.tinypoll.io/security.html
A one-page overview for security and procurement reviewers. Each point below maps to a specific technical control; the full statement adds the detail — and states plainly what we don't yet have.
Encryption
TLS 1.2+ in transit everywhere. At rest, DynamoDB uses AWS-managed keys. The Slack bot token and Google refresh token get an additional layer of field-level encryption with a dedicated customer-managed KMS key that rotates yearly, bound to the workspace it belongs to.
Tenant isolation
Every record is partitioned by teamId and every query is keyed to the caller's workspace. Mutating actions re-check Slack admin status server-side. No admin HTTP endpoints; /health exposes no PII.
Deletion & erasure
PII deleted on uninstall / token revocation within 30 days, with a daily backstop. Self-serve and admin erasure available, distinct from opt-out. A minimal billing tombstone is kept; PITR backups may retain data for up to ~35 days.
Secrets
All application secrets live in AWS SSM Parameter Store (SecureString) — never in source, environment, or CI. The OAuth-token KMS key is separate again.
AI (optional)
Off unless an admin enables it; consent recorded. AI inference runs on AWS Bedrock (Claude) in AU regions only. Nothing sent is stored, logged, or used for training. Only display name, optional job title, workspace name, occasion and years/age are sent.
Sub-processors
AWS (hosting, Sydney), Stripe (payments), Slack (platform), Google (only with Workspace sync), KLIPY (only with meme GIFs), and AWS Bedrock / Anthropic (only with AI messages, AU regions). Full list: confetti.tinypoll.io/subprocessors.html. Application security includes signed Slack HMAC requests with replay protection, verified Stripe webhooks, signed OAuth state, and short-lived (1h) billing tokens.
Report an issue: security@tinypoll.io · we acknowledge within ~3 business days