AssurAI is built for audit and compliance professionals who handle the most sensitive financial and operational data in their organisations. Here's exactly how we protect it.
DDoS protection, web application firewall, bot mitigation, global edge caching across 300+ cities
Serverless functions, SSL/TLS termination, atomic deployments, zero-downtime updates. hosted on SOC 2 Type II certified infrastructure.
Managed PostgreSQL with row-level security, point-in-time recovery, automated backups every 24h retained for 7 days. SOC 2 Type II, ISO 27001, HIPAA eligible.
AI processing via Anthropic's API. Data sent for inference is not used for model training. Anthropic is hosted on SOC 2 Type II certified infrastructure.
All data between your browser and our servers is encrypted with TLS 1.3. Older protocols (TLS 1.0, 1.1) are rejected.
All database data is encrypted at rest using AES-256. This includes workpapers, findings, projects, and all user data.
Automated daily backups are encrypted before storage. Point-in-time recovery available for the last 7 days.
All AssurAI pages and APIs are served over HTTPS. HTTP requests are automatically redirected. HSTS enforced.
API keys and secrets are stored as encrypted environment variables. They are never embedded in code or logs.
Evidence files and attachments are stored in Supabase Storage with per-object access controls and signed URLs.
Admin, Manager, Auditor, and Reviewer roles with granular permissions per module.
MFA available for all users. Enterprise customers can enforce MFA organisation-wide.
Connect your identity provider (Okta, Azure AD, Google Workspace) for centralised access control.
Every action — view, create, edit, approve, export — is logged with timestamp, user, and IP address.
AssurAI staff can only access your data with your explicit written consent — for example, to diagnose a support issue you've reported.
Any support access is logged, time-limited, and immediately revoked when the issue is resolved.
Your data is never used to train AI models — by AssurAI or by Anthropic. AI inference is stateless.
Default region for all customers. Data centre in Northern Virginia. Suitable for US customers and those without specific data residency requirements.
Default — ActiveFrankfurt, Germany. GDPR-compliant data residency for EU/EEA customers. Data never leaves the EU. Available for Professional and Enterprise plans.
Available on requestLondon. Post-Brexit UK data residency for customers with UK GDPR requirements. Planned for rollout Q3 2026.
Planned Q3 2026Singapore. For customers in APAC region with local data residency requirements. Planned for rollout Q4 2026.
Planned Q4 2026| Provider | Purpose | Data processed | Location | Certifications |
|---|---|---|---|---|
| Supabase | Database, Authentication, Storage | All customer data | AWS us-east-1 (US) / eu-central-1 (EU) | SOC 2 Type II · ISO 27001 · HIPAA eligible · GDPR |
| Anthropic | AI / LLM inference | Prompts submitted for AI analysis | United States | SOC 2 Type II · No training on customer data |
| Netlify | Application hosting, CDN, Functions | Request logs, function execution | Global edge (AWS + GCP) | SOC 2 Type II · GDPR |
| Cloudflare | CDN, DDoS protection, WAF | Request metadata (no content) | Global edge network | SOC 2 Type II · ISO 27001 · GDPR |
| Resend | Transactional email | Email address, notification content | United States | SOC 2 Type II · GDPR |
| Stripe | Payment processing | Billing information only | United States | PCI DSS Level 1 · SOC 2 · ISO 27001 |
Automated monitoring alerts on anomalous access patterns, failed authentication spikes, or unusual data export volumes. Sentry monitors application errors in real-time.
On confirmed incident, affected accounts are immediately suspended and access tokens revoked. The attack surface is isolated within minutes.
We determine what data was accessed, by whom, and for how long. We assess whether it constitutes a personal data breach under GDPR Article 4(12).
Affected customers are notified with a plain-language summary of what happened, what data was affected, what we've done, and what they should do.
Root cause analysis, patch deployment, and a post-incident report published to affected customers. Process improvements implemented.
Email security@getassurai.com with details of the vulnerability. We will acknowledge within 48 hours and keep you informed of our progress.
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, following responsible disclosure principles.
We aim to patch critical vulnerabilities within 24 hours, high severity within 7 days, and medium severity within 30 days of confirmed report.
Verified reporters are acknowledged in our security hall of fame (with permission). We do not currently offer a paid bug bounty programme.