Security

Hosting and data residency

• Customer data lives in Neon Postgres, London region. No customer data is replicated outside the EU.
• The application runs on Vercel, London region (Edge + Node serverless functions).
• Transactional email goes through Postmark EU servers.

Encryption

• In transit: TLS 1.3 everywhere — HTTPS-only at the edge, TLS to Postgres, TLS to all third-party APIs.
• At rest: AES-256 encrypted disk volumes (Neon default).
• Credentials: channel OAuth tokens are stored encrypted at the column level via pgcrypto.

Tenant isolation

• Every row of every table carries a workspace_id.
• All queries are scoped through an authenticated session — there is no admin path that returns unscoped data.
• Postgres row-level security policies enforce the same constraint at the database layer.

Access control

• Authentication via Clerk: bcrypt password hashing, optional multi-factor, session expiry.
• Role-based access within each workspace (owner, staff).
• Internal access to production data is restricted to named individuals and logged.

AI safety

• Every AI-generated reply passes through a separate verifier model (Claude Haiku) that blocks any factual claim not grounded in the business's own knowledge base.
• All replies are logged with their grounding sources, visible to the workspace owner in the dashboard.
• Anthropic and OpenAI do not train on data sent via their commercial APIs.
• Replies include a mandatory disclosure that they were sent by an AI assistant (EU AI Act compliance).

Audit trail

Every AI invocation is persisted in an agent_runs table with: model used, token counts, tool calls, draft text, verifier verdict, and final decision. Owners can audit any conversation in their dashboard. Logs are retained for 12 months.

Incident response

We will notify affected customers within 72 hours of confirming a personal-data breach, per GDPR Art. 33. Notification will go to the email address tied to your account and include scope, impact, and mitigation steps.

Backups and durability

• Neon point-in-time recovery: 30-day retention on all production databases.
• Daily logical snapshots stored encrypted in the EU region.

Reporting a vulnerability

Please email info@accelereight.net with details. We respond within 2 business days and do not pursue good-faith security research.

Roadmap

We are working towards SOC 2 Type II and ISO 27001. Penetration testing is scheduled annually once we cross 25 paying customers. Current status: early-stage SaaS with security-aware engineering, no formal certifications yet — we will not claim compliance we don't hold.