BUILDER MODE You're editing your public Trust Portal — changes save to your Supabase org config.
🛡️ Security & Compliance Trust Portal

AssurAI Security Posture

We take security seriously. Review our certifications, security practices, policies, and data handling commitments below.

SOC 2 In Progress GDPR Compliant HIPAA Ready Zero Data Retention AI 99.9% Uptime SLA
🏅 Certifications & Compliance
In Progress
SOC 2 Type II
Audit window: Q3 2026
Planned
ISO 27001
Target: Q1 2027
Applicable ✓
HIPAA
BAA available on request
Compliant ✓
GDPR
DPA available · EU SCCs in place
N/A
PCI DSS
No cardholder data processed

Edit certification statuses (JSON):

🔒 Security Overview
🔐
Encryption at Rest
AES-256 via Supabase / AWS
🔒
Encryption in Transit
TLS 1.3 on all connections
🌎
Data Residency
AWS us-east-1 (US)
📈
Uptime SLA
99.9% — Status page available
🔍
Penetration Testing
Annual — Last: Q1 2026
🛡️
Vulnerability Scanning
Weekly automated scans
🚨
Incident Response
<72h notification SLA
👤
Access Control
MFA required · RBAC · SSO
💾
Data Backup
Daily backups · 30-day retention

Edit security details (one per line: Icon | Label | Value):

📋 Policies
📄 Privacy Policy
📄 Security Policy (Summary)
📄 Acceptable Use Policy
📄 Data Retention Policy
🤖 AI & Data Handling
🧠
AI Provider
Anthropic Claude with Zero Data Retention (ZDR) policy. Prompts are never used for training.
🚫
Zero Data Retention
Your data is not retained by AI providers. ZDR agreement in place with Anthropic.
🔌
BYOLLM Option
Enterprise customers can bring their own LLM (Azure OpenAI, Gemini) for full data sovereignty.
📚
Training Data
Your data is never used to train AI models. We have contractual commitments from all AI providers.
🗑️
Data Deletion
All customer data deleted within 30 days of account termination. Deletion certificate available.
🏢
Data Isolation
Strict multi-tenant isolation via Row Level Security (RLS) in Supabase. Org data never commingled.
🏢 Subprocessors

The following vendors process customer data on our behalf. We maintain Data Processing Agreements with all subprocessors.

Vendor Service Location Certification DPA
Anthropic AI inference (Claude) US SOC 2 Type II Yes ✓
Supabase Database & Auth AWS us-east-1 (US) SOC 2 Type II Yes ✓
Netlify Web Hosting & Functions US SOC 2 Type II Yes ✓
Cloudflare CDN & WAF Global SOC 2 Type II, ISO 27001 Yes ✓
Brevo Transactional Email EU ISO 27001 Yes ✓

Last updated: August 2026. View full subprocessor registry →

💬 Ask About Our Security

Ask any question about our security practices, certifications, or data handling.

👋 Hi! I'm AssurAI's security assistant. Ask me anything about our security posture, certifications, data handling, or compliance programmes.