Compliance
What we have in place, what we are working on, and the paperwork your security review will ask for. Everything on this page describes the running code or a dated plan; nothing is aspirational marketing.
Data retention you control
Owners choose how long report files are kept: 30 days, 90 days or a year, depending on the plan; self-hosted installations can also keep them until deleted. An hourly sweep removes the files of runs past that age and the links to them, so nothing can be served afterwards.
The run itself stays in your history with its ranking statistics, so trends keep their past. Object-storage copies are removed by the storage lifecycle, not by the sweep, which never deletes objects.
Where your files live
This deployment keeps report files in one place: Amazon S3, ap-southeast-1. Operators can offer several regions with PGSENPAI_S3_REGIONS; organisations on plans with region choice then pick where their files are written.
SOC 2 roadmap
6 done · 3 in progress · 3 planned
-
Done
Encryption in transit and at rest · CC6.1, CC6.7
HTTPS with HSTS is enforced when the site is deployed behind TLS; saved database passwords, Slack webhooks and model tokens are encrypted with a key separate from the session key; report files in object storage rely on the bucket's server-side encryption.
-
Done
Least privilege towards customer databases · CC6.3
Analyses run read-only statements with statement and lock timeouts; the read-only role generator gives customers a login that can read statistics and nothing else.
-
Done
Access control and roles · CC6.1, CC6.2
Organisations with owner, analyst and viewer roles; only owners change settings, invite people or delete shared connections. Administrator actions are separate from customer accounts.
-
Done
Data retention and deletion controls · C1.1, C1.2
Owners choose how long report files are kept (30, 90 or 365 days, or until deleted) within their plan; an hourly sweep removes expired files and links. Account deletion removes every analysis at once.
-
Done
Regional storage · P4.1, CC6.7
Deployments can offer several storage regions; an organisation chooses where its report files are written.
-
Done
Change management · CC8.1
Every change goes through version control, automated tests on both supported databases, static typing and linting before deployment.
-
In progress
Audit trail · CC7.2
Runs record who started them, from which schedule or API token, and on which worker. Security-relevant account events (logins, role changes, deletions) are being moved into a queryable audit log.
-
In progress
Vulnerability management · CC7.1
Static security analysis (bandit, ruff's security rules) runs on every change; a coordinated disclosure address is published in /.well-known/security.txt. Dependency vulnerability scanning and periodic third-party penetration testing are being arranged.
-
In progress
Written policies and risk assessment · CC1.1–CC3.4
Information security, access, incident response and vendor management policies are being written down in the form auditors expect, based on what the code already enforces.
-
Planned
Continuous monitoring and alerting · CC7.2, A1.1
Health checks and a public status page exist; alerting on error rates and failed runs to an on-call rota is planned.
-
Planned
SOC 2 Type I report · All
A readiness assessment with an auditor, then the Type I report on the design of the controls above.
-
Planned
SOC 2 Type II report · All
Observation period of at least six months after Type I, then the Type II report on operating effectiveness.
Criteria refer to the AICPA Trust Services Criteria (Security, Availability, Confidentiality, Privacy). Enterprise customers can request the current controls matrix.
Data processing agreement
A DPA template written for this service: what is processed, why, for how long, the security measures, breach notification within 72 hours, sub-processors, deletion and audits. Read it in the browser or download the text for your legal team; fill in your legal name to have it pre-filled.
Sub-processors on this deployment
| Service | Purpose | Where |
|---|---|---|
| Object storage | Report files after an analysis finishes | Amazon S3, ap-southeast-1 |
| PostgreSQL database | Accounts, analyses, file links, statistics | PostgreSQL run by the operator of this site |
| Email delivery | Verification, invitations, notifications | smtp-relay.brevo.com |
Model providers for AI recommendations are chosen and paid for by you; your token goes to the provider you pick and nowhere else.
Status and incidents
The status page shows the live health of every component of this deployment and any maintenance notice; /status.json is there for your monitors. Security problems: see the security page for how to report one.