Posture at a glance
✓Encryption at restAES-256 (Supabase + Storage)
✓Encryption in transitTLS 1.3 · HSTS preload
✓AuthenticationSAML SSO · OAuth · TOTP MFA
✓Tenant isolationRow-level security at Postgres
✓Cross-org accessOLAC RPCs · audit-on-read
✓Webhook integrityHMAC SHA-256 verification
✓GDPR + CCPACompliant · DPA · EU residency on Enterprise
!SOC 2 Type IIIn progress · target Q3 2026
!First pen-testScheduled pre-Enterprise contract
Encryption
In transitTLS 1.3 enforced on every endpoint. HSTS preload-eligible.
At restAES-256 column-level + storage-level encryption via Supabase (Postgres) and S3-compatible object storage.
SecretsStored in Railway and Vercel secret stores; never in code or version control.
Access control
Row-Level SecurityEvery database table enforces RLS. Your org's data is isolated from every other org at the query layer — not just at the application layer.
OAuth + SSOStandard OAuth via Google. SAML SSO (Okta / Azure AD / Auth0) available on Enterprise plans.
Role-basedOwner, admin, brand_manager, and viewer roles within each organization. Maison-level isolation for multi-brand parent companies.
Audit logEvery write operation appends to an audit trail (writes by user, target, payload digest, timestamp).
Data residency
Primary regionUS-East (Supabase managed). EU-residency option available on Enterprise tier for GDPR-bound customers.
BackupsPoint-in-time recovery, 7 days. Daily snapshots, 30 days. Disaster-recovery target: 4h RTO, 1h RPO.
DeletionRight-to-deletion endpoint available. Cascading delete across all sub-systems within 30 days. Audit records retained 7 years per industry standard.
Sub-processors
We engage the following vendors. Each has its own enterprise security posture and signed DPA with us where applicable.
SupabasePostgres database + auth + storageSecurity → AnthropicModel provider for brief structuring + creator analysisSecurity → StripePayments + creator payouts (Stripe Connect Express)Security → ApifyPublic-data scraping for creator analysis (no PII)Security → Compliance
SOC 2 Type IIIn progress. Target attestation Q3 2026.
GDPRCompliant. DPA available on request. EU data-residency available on Enterprise plans.
CCPACompliant. Right-to-access and right-to-deletion endpoints exposed under Account → Data. PCI-DSSPayment card data never touches our servers — handled entirely by Stripe (PCI-DSS Level 1).
Incident response
Disclosure SLASecurity incidents disclosed to affected customers within 72 hours of confirmed impact.
On-callSecurity on-call rotation 24/7 for production-impacting incidents.
AI & data usage
No training on your dataWe do not use your campaign briefs, creator dossiers, or proprietary insights to train any model.
Provider opt-outsAnthropic and OpenAI requests are made via API tier with training opt-out enabled by default.
Output retentionModel outputs are stored in your org's schema and treated as customer data — same RLS, same deletion guarantees.
Documentation on request
We provide the following to procurement teams under NDA:
- Architecture diagram + data-flow document
- Penetration-test summary (last engagement and remediation)
- Security questionnaire response (CAIQ-Lite or SIG-Lite)
- Data Processing Agreement (DPA)
- Sub-processor list with regional residency
- Insurance: cyber + E&O coverage attestations
Want our security white paper, DPA, sub-processor inventory?
Available under NDA · email trust@betr.studios
Last reviewed · November 2026