AssurAI is a SaaS GRC platform for internal audit, SOX, and compliance teams. It accelerates evidence testing, workpaper preparation, and audit reporting using AI. The platform is a static HTML front-end backed by serverless Netlify functions, a Supabase PostgreSQL database, and the Anthropic Claude API for AI inference.
| Control | Implementation | Standard / Note |
|---|---|---|
| Encryption at rest | AES-256 (Supabase / AWS storage layer) | Industry standard · Always on |
| Encryption in transit | TLS 1.3 enforced on all connections · HSTS | TLS 1.0/1.1/1.2 rejected |
| Authentication | JWT + Google SSO / Azure Entra ID SSO | OAuth 2.0 / OIDC · 1-hr token expiry |
| Authorisation | PostgreSQL Row Level Security (RLS) per org_id | Database-level · Cannot be bypassed |
| Data retention (AI) | Zero data retention — Anthropic enterprise API (ZDR) | Contractually guaranteed by Anthropic |
| AI model training | Customer data excluded from all model training | Anthropic enterprise API policy |
| Backups | Daily encrypted backups · 30-day retention · PITR | AWS standard · RTO 4 hours |
| Evidence integrity | SHA-256 hash on every evidence file at ingestion | Tamper-evident · Re-verified on access |
| Monitoring | Supabase audit logs · Sentry real-time error tracking | Continuous · Anomaly alerting |
| Network / DDoS | Cloudflare WAF + DDoS protection · Netlify CDN | CDN-level · SOC 2 Type II |
| API key management | Encrypted environment variables — never in client code | Zero secret exposure in front-end |
| Access control | RBAC — Admin / Manager / Auditor / Viewer roles | Granular per-module permissions |
| Staff data access | By explicit written consent only · Logged · Time-limited | Cannot access client data without consent |
| Incident notification | Within 72 hours of confirmed breach | Meets GDPR Article 33 |
Zero Data Retention: Client data submitted to the Anthropic Claude API is processed in real-time and immediately discarded upon response. Anthropic's Zero Data Retention (ZDR) policy for enterprise API customers means no client data is stored, cached, or used for model training. This is contractually guaranteed by Anthropic's enterprise API terms of service.
No model training: AssurAI audit evidence, workpapers, findings, and financial data are never used to train, fine-tune, or improve any AI model — by AssurAI or by Anthropic. AI inference is stateless — each request is isolated and independent.
What AssurAI stores: AssurAI stores only the data you explicitly save to the platform — workpapers, findings, controls, and engagement files in your dedicated Supabase database. Documents uploaded for AI analysis are processed in memory; only the AI-generated output is stored if you choose to save it.
AssurAI supports four AI providers. Your data goes to whichever provider you choose — under your agreement with them.
| Provider | Data Location | New Vendor Needed? | Status |
|---|---|---|---|
| Anthropic Claude (default) | US (Anthropic) | No (AssurAI agreement) | ✅ Default |
| Google Gemini (BYOLLM) | Your Google Cloud | No | ✅ Live |
| Azure OpenAI (BYOLLM) | Your Azure region | No | ✅ Live |
| OpenAI GPT-4o (BYOLLM) | OpenAI servers | No | ✅ Live |
When using BYOLLM, AssurAI acts as the audit workflow layer only. All AI calls route through your provider under your existing data agreement. AssurAI never stores the raw prompt data sent to your provider.
| Provider | Role | Certifications |
|---|---|---|
| Supabase (via AWS) | Database, authentication, storage | SOC 2 Type II · ISO 27001 · HIPAA eligible · GDPR |
| Netlify | CDN, serverless functions (no data stored) | SOC 2 Type II · GDPR |
| Anthropic | AI / LLM inference — zero retention | SOC 2 Type II · ZDR policy · No training on customer data |
| AssurAI Inc. | Application layer | SOC 2 Type II certification in progress (2027) |
Sub-processor SOC 2 reports available under NDA. Contact security@getassurai.com to request.
AssurAI supports: security questionnaires (VSQ / CAIQ / SIG Lite), custom DPAs, mutual NDAs, architecture review calls, penetration test reports (under NDA), and BYOLLM configuration for KSA / Azure deployments.