Trust & Security
We hold ourselves to the same standard we set for our customers.
Audulate runs its own GDPR scanner on itself. Here's everything we do to keep your data safe and earn your trust.
Audulate scores 97/100 on its own GDPR scanner
We eat our own cooking. Our platform continuously monitors audulate.com and the app for GDPR compliance — the same way it monitors our customers. You can request our latest scan report as an Enterprise customer.
Certifications & audits
GDPR posture
Audulate scans its own platform using the same engine we sell. The current scan score is published in our most recent sample report.
SOC 2 Type II
Not yet pursued. Our sub-processor list is published in our Privacy Policy; the internal security questionnaire and DPA template are available on request. We will publish an engagement timeline only when the work is contracted.
ISO 27001
On our long-term roadmap, dependent on SOC 2 outcome. We will not publish a timeline until the ISMS work is funded and scoped.
Independent security review
No third-party penetration test has been completed yet. Internal review is ongoing. We will publish a summary report once an independent test is run.
Security measures
Encryption in transit and at rest
TLS 1.3 in transit across our hosting stack (Vercel, Supabase, Upstash defaults). AES-256 at rest for the PostgreSQL database (Supabase managed encryption). Authentication is managed by Supabase Auth (GoTrue), which bcrypt-hashes credentials — we never store raw passwords. Secrets live in environment variable vaults, not source code.
EU data residency (Frankfurt)
Tenant data is stored in the EU: the primary PostgreSQL database runs on Supabase eu-central-1 (Frankfurt) — matching the sub-processor table above and the DPA. Vercel serves the frontend and API from EU edge regions. Where US processors are involved (Vercel control plane, OpenAI/Anthropic for AI features, Stripe for billing), Standard Contractual Clauses cover the transfer.
Role-based access control
Five-tier RBAC inside the platform: Owner, Admin, Compliance Manager, Developer, Auditor. Each role has scoped permissions enforced server-side via Fastify route guards (see apps/api/src/plugins/rbac.ts).
Audit logging
Every compliance-relevant action is written to one of five append-only audit-log tables (ActivityLog, RiskAuditLog, MemberAuditLog, AdminAuditLog, AiAuditLog). Immutability is enforced at the database layer — Postgres triggers block DELETE and UPDATE so the application cannot silently rewrite history. Logs are retained per the plan policy and exportable to Enterprise customers.
Multi-tenant isolation
Every database row is scoped by tenantId and every API route verifies the caller's membership before reading or writing. Isolation is exercised by an automated cross-tenant test suite (apps/api/src/tests/tenant-isolation.test.ts) that runs in CI on every commit. Owner / Admin impersonation requires a separate audited admin login, not a tenant credential.
Backup & recovery
Postgres point-in-time recovery is provided by Supabase (continuous WAL archiving) with a daily full backup. Recovery objectives: RPO ≤ 24 hours, RTO ≤ 2 hours. Cloudinary-stored evidence (CAPA attachments, audit-package ZIPs) is versioned at the provider and re-creatable from the database state. Restore drills are documented in our internal supabase-backup-restore-drill runbook and exercised quarterly.
Breach notification commitment
If a security incident materially affects customer data, we notify affected account owners by email within 72 hours of confirmation — aligned with GDPR Article 33. Our incident response runbook is internal but reviewable on request.
We scan ourselves
Every pull request to our own repositories runs through the same GitHub PR scanner we sell. Dependencies are watched for CVEs. The most recent scan of our marketing site is published as a sample report — no signup required.
What we don't do (yet)
We'd rather list the gaps than have you discover them mid-procurement. Each item below is on our radar; none are commitments with dates.
- No SOC 2 attestation yet — see Compliance posture above
- No independent penetration test yet
- No on-premises or air-gapped deployment
- No SAML SSO yet — Google + email login only (SSO on roadmap for Enterprise tier)
- No FedRAMP / IL5 / public-sector accreditations
Privacy contact
Privacy contact — Audulate
Privacy questions, data-subject requests and complaints
[email protected]Our DPO is responsible for overseeing our data protection strategy, ensuring compliance with GDPR, and acting as the primary point of contact for data subjects and supervisory authorities. The DPO operates independently and reports directly to senior management.
Sub-processors
List last reviewed:
The third parties that process tenant data on our behalf. See thePrivacy Policyfor the canonical list and our Data Processing Agreement for the contractual safeguards.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | PostgreSQL database + auth (primary data store) | EU — Frankfurt (eu-central-1) |
| Vercel | Hosting for frontend + serverless API + landing site | EU edge + US control plane (SCCs) |
| Railway | Worker service hosting (BullMQ consumers, crons, scan workers) | EU — Frankfurt |
| Cloudinary | Encrypted file storage (CAPA attachments, audit-package ZIPs, evidence) | EU + US (SCCs) |
| Upstash | Redis (BullMQ queues + ephemeral cache) | EU |
| Stripe | Billing + subscription management | US (SCCs in place) |
| Resend | Transactional email delivery (alerts, invites, reminders) | US (SCCs in place) |
| GitHub (Microsoft) | PR-scanning integration — receives webhook payloads + reads PR diffs for connected repos | US (SCCs in place) |
| OpenAI | AI-powered compliance checks (privacy-policy completeness, cookie-banner quality) and the in-app Compliance Copilot (read-only AI assistant over your own workspace data) | US (SCCs in place) |
| Anthropic | AI-powered compliance summaries and remediation guidance (Claude) | US (SCCs in place) |
| Cloudflare | CDN + DDoS protection for marketing site | Global edge |
Responsible disclosure
If you believe you've found a security vulnerability in Audulate, please report it responsibly. We will acknowledge your report within 24 hours, keep you informed of our progress, and publicly credit you if you wish once the issue is resolved.
Report a vulnerability