Metro Retro uses standard security practices like encryption and optional SSO on select plans. However, it is not SOC 2 Type II certified and not GDPR compliant, which may be a consideration for teams handling sensitive or regulated data.
TeamRetro on the other hand, is built with enterprise-grade security from the ground up. It is Soc2 Type 2 and GDPR compliant and can be hosted in either the US or the EU. Detailed information can be found here.