Where Your Data Lives
Every component in the AssurAI stack is built on SOC 2 Type II certified infrastructure. No audit data is stored on Netlify's CDN — your data lives exclusively in your Supabase database.
Row-Level Security
Your data is cryptographically isolated by organisation ID at the database engine level — not in application code. This means no query can ever cross organisational boundaries, even if application code contains a bug.
Every query filtered by org_id
PostgreSQL Row Level Security (RLS) policies are enforced on every table. There is no application-level bypass. The database engine rejects any query that attempts to read or write data outside your organisation.
No shared tables — cryptographic isolation
While infrastructure is shared at the Starter and Professional tiers, your data is isolated by RLS at every row. Enterprise customers receive a dedicated database instance for physical separation.
AssurAI staff cannot access your data
Even AssurAI engineers cannot query your organisation's data without your explicit written consent. Any support access is time-limited, logged, and immediately revoked when the issue is resolved.
-- Applied to every table in the AssurAI schema CREATE POLICY org_isolation ON workpapers FOR ALL USING (org_id = current_user_org()); CREATE POLICY org_isolation ON evidence_files FOR ALL USING (org_id = current_user_org()); -- current_user_org() reads from the validated JWT token. -- The database rejects any query where org_id doesn't match.
Encryption — At Rest & In Transit
Your data is encrypted at every stage. There is no option to disable encryption — it is always on by default.
How AI Uses Your Data
Your audit evidence never trains AI models — ever.
When you use AI features in AssurAI, your data is sent to the Claude API for real-time analysis only. Here is exactly what happens to it.
Note on Anthropic's data retention: Anthropic's enterprise API terms provide for zero data retention (ZDR) — no API data is stored beyond the duration of the inference request. This is the configuration used by AssurAI for all AI processing. Refer to anthropic.com/privacy for current published policy. Enterprise customers may request written confirmation of ZDR agreement.
Authentication & Access Control
Enterprise-grade identity management — from Google SSO to Azure Entra ID, with role-based access enforced at every layer.
Identity & SSO
Google SSO (OAuth 2.0)
One-click sign in via Google Workspace — no passwords stored in AssurAI.
Microsoft Azure AD / Entra ID SSO
Full integration with Azure Active Directory / Entra ID for enterprise identity management.
JWT token-based sessions
Short-lived JWT tokens (1-hour expiry). Refresh tokens are rotated on each use and can be revoked instantly.
MFA enforcement (Enterprise)
Organisation-wide MFA enforcement coming for Enterprise plan.
SCIM provisioning (Enterprise)
Automated user lifecycle management from your IdP on Enterprise plan.
Access Control
Role-based access control (RBAC)
Admin · Manager · Auditor · Viewer — granular permissions per module.
Session expiry enforcement
Idle sessions automatically expire. Users must re-authenticate after inactivity.
Full audit trail
Every action — view, create, edit, approve, export — logged with timestamp, user, and IP address.
AssurAI staff access by consent only
Staff can only access your data with explicit written consent — for diagnosed support issues only.
Infrastructure Certifications
AssurAI is built on certified infrastructure. We inherit the security controls and audit attestations of our sub-processors.
AssurAI Inc. is pursuing SOC 2 Type II certification. In the meantime, our platform inherits controls from our certified infrastructure providers. We are happy to provide sub-processor SOC 2 reports under NDA. Contact security@getassurai.com.
| Provider | Purpose | Location | Certifications |
|---|---|---|---|
| Supabase | Database, Auth, Storage | AWS us-east-1 (US) | SOC 2 Type II · ISO 27001 · HIPAA · GDPR |
| Netlify | CDN, Serverless functions | Global edge (AWS + GCP) | SOC 2 Type II · GDPR |
| Anthropic | AI / LLM inference | United States | SOC 2 Type II · Zero Data Retention |
| Cloudflare | DDoS protection, WAF | Global edge | SOC 2 Type II · ISO 27001 · GDPR |
| Stripe | Payment processing | United States | PCI DSS Level 1 · SOC 2 · ISO 27001 |
For Enterprise & Regulated Clients
AssurAI is designed for organisations operating in the world's most regulated environments — including Saudi Arabia's NCA framework, UAE, and international financial institutions.
🇸🇦 KSA & NCA Compliance — BYOLLM on Azure KSA North
For Saudi organisations subject to NCA (National Cybersecurity Authority) Essential Cybersecurity Controls — including SABIC, ARAMCO, SAMA-regulated institutions, and Saudi government entities — AssurAI supports full KSA data residency via our BYOLLM (Bring Your Own LLM) integration with Azure OpenAI on Azure KSA North. Your audit data never leaves Saudi infrastructure.
KSA data residency via BYOLLM on Azure KSA North
Connect AssurAI to your own Azure OpenAI instance. AI processing stays within Saudi borders. Suitable for NCA-regulated organisations.
NDA available on request
Mutual non-disclosure agreement available before evaluation. Signed within 24 hours. Contact security@getassurai.com.
Security questionnaire support
We complete vendor security questionnaires (VSQs), CAIQ, SIG Lite, and custom security questionnaires for procurement and InfoSec teams.
Architecture review calls
We offer architecture review calls with our technical team for enterprise evaluations. Schedule via shakeel@getassurai.com.
Custom Data Processing Agreement (DPA)
Standard DPA available for all customers. Enterprise customers can request a customised DPA for specific jurisdictional or contractual requirements.
Penetration testing report available
Automated security scan results and penetration testing report available under NDA for Enterprise evaluations.
Enterprise security inquiries
📧 security@getassurai.com — architecture reviews, VSQs, NDAs, DPAs, and KSA/BYOLLM configuration
Security Disclosure
If you discover a security vulnerability in AssurAI, we want to hear from you. We take all reports seriously and commit to responding quickly.
📬 Report a vulnerability
Email security@getassurai.com with the details of the vulnerability, steps to reproduce, and your contact information.
Our commitments: Acknowledge within 24 hours · Resolve critical issues within 72 hours · Resolve high severity within 7 days · Medium severity within 30 days.
Safe harbour: We will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, following responsible disclosure principles. Verified reporters are acknowledged in our security hall of fame with permission.