Data and privacy FAQ
The short version of how your SOPs are stored and protected, with links to the full Security and compliance section.
This page is the short version. The full detail on hosting, access rules, roles, AI handling and what SOPCompass does not claim is in Security and compliance, and the security page summarizes it.
Important: SOPCompass is not SOC 2 audited, HIPAA compliant or GDPR certified. Don’t put regulated data such as health records or card numbers in SOPs.
Common questions
Where is my data stored?
In Supabase (database, sign-in and file storage). The app is hosted on Vercel. Access rules are enforced inside the database, so each request only returns rows from workspaces the signed-in person belongs to.
Who owns my SOPs?
You do. Your content is yours, and you can get it out at any time through PDF and Word exports, the API on Business, or by asking us for an export.
Can people in other workspaces see my SOPs?
No. A workspace's SOPs are visible only to its members, to anyone you give a share link, and, on Business, to other workspaces you deliberately share a library with.
Is my content used to train AI?
No. SOPCompass does not train AI models on your content. AI features send the content a request needs to Anthropic's API to generate a response.
Which services process my data?
Supabase (database, sign-in, storage), Vercel (hosting), Anthropic (AI features), ElevenLabs (voice interviews), Whop (checkout and billing) and an email delivery service for notifications. The Security and compliance section has the full list.
Is SOPCompass SOC 2, HIPAA or GDPR certified?
No. SOPCompass is not currently SOC 2 audited or certified, is not HIPAA compliant and does not hold a GDPR certification. Please don't store protected health information, payment card data or similar regulated data in SOPs.
Do you store card details?
No. Payments are taken on Whop's checkout, and card numbers never pass through or get stored by SOPCompass.
Can a share link be found by search engines?
Share links are long random addresses that SOPCompass doesn't list or publish anywhere. But anyone who has a link can open it, and a link posted on a public page can be found, so revoke links you no longer need.
What does the capture extension send?
Only the steps and screenshots of a capture you start, in the tab you started it in and tabs that page opens. It never records typed values or credential fields. See the capture extension FAQ.
What happens to my data if I cancel?
The workspace becomes read-only and everything is kept, so you can restart later. To have data deleted, email support@ironbridgeaiadvisory.com.
Can I get a security questionnaire answered?
Yes. Email support@ironbridgeaiadvisory.com and we will give you straight answers. Report a vulnerability privately to the same address.