Security

Data Residency

• Hosting location: Customer data is hosted in the United States, in the West US (Oregon) region (AWS us-west-2), through our infrastructure provider, Supabase, which runs on AWS
• Data sovereignty: Customer data is stored within the United States
• Backups: Our cloud provider performs continuous backups with point-in-time recovery

Encryption

• At rest: Data is encrypted using AES-256, including database records, file storage, and backups
• In transit: Connections are encrypted with TLS. We serve all endpoints over HTTPS
• Key management: Encryption keys are managed through our cloud provider's KMS

Access Controls

• Row-Level Security (RLS): Database-level tenant isolation ensures that each organization can only access its own data, enforced at the database query layer
• Tenant Isolation: Logical separation between customer environments, so one organization cannot read another's data
• Role-Based Access Control (RBAC): Permissions let organizations control what team members can view, edit, and administer
• Authentication: Authentication via Supabase Auth (email/password)
• Session Management: Session expiration and secure token refresh

Infrastructure and Compliance

AuditAble runs on Supabase, which is built on AWS. Our infrastructure provider maintains SOC 2 Type II, ISO 27001, and HIPAA compliance certifications, so your data sits on independently audited infrastructure. AuditAble does not currently hold its own SOC 2 attestation. We are happy to share our security practices and respond to procurement security questionnaires on request.

Incident Response

• Notification: If a security incident affects your data, we will notify you promptly and in line with applicable law
• Review: We investigate confirmed incidents, determine the root cause, and take corrective action
• Communication: Notifications are sent by email to your designated contacts

Employee Access

• Principle of least privilege: Access to production systems is limited to what is necessary
• Access logging: Administrative access to customer data is logged (for example, support impersonation is recorded in an audit log)

Data Retention and Purge

• Active customer data (scans, reports, and findings) is retained for the life of your subscription so you can track readiness over time
• After you cancel, your compliance history stays available to download for 12 months. After that, it is permanently deleted, including from backups within 90 days
• Backups are managed by our cloud provider with point-in-time recovery, and backup copies age out on the provider's standard retention cycle
• Customers can request data deletion at any time
• When data is deleted, all copies, including backups, are removed within the backup retention window

Government Compliance

• FERPA Compatible: Our platform does not process student education records. Scanning is limited to publicly available website content.
• CIPA Compatible: Our services do not involve content filtering or monitoring of individual internet usage.
• Data Sales Prohibition: We never sell customer data. This commitment is contractually binding.

Contact Our Security Team

For security questions, to request documentation, or to report a vulnerability, please contact us:

• Email: [email protected]
• For responsible disclosure of security vulnerabilities, please email [email protected] with details. We will acknowledge your report as quickly as we can.