ActiveCampaign is DGPR, SOC 2 and HIPAA compliant. It also uses automated tools to scan code and infrastructure to detect suspicious activity.
It also has an ongoing campaign to ‘hack’ itself to identify potential vulnerabilities.