SOPCompass
Start free trial
Help center

Security and compliance

How your data is stored, protected and controlled.

  1. Security architecture overviewSOPCompass is a web app hosted on Vercel, backed by a Supabase project with Postgres, authentication and file storage. Access rules live in the database as row-level security, not only in the interface.
  2. Where your data is storedYour database and files live in Supabase's us-east-1 (Northern Virginia, United States) region. AI requests are processed by Anthropic, and voice interviews by ElevenLabs, under their own terms.
  3. Encryption in transit and at restConnections use HTTPS with TLS 1.2 or 1.3, and Supabase states data is encrypted at rest with AES-256. SOPCompass hashes API keys and tokens but adds no field level encryption.
  4. Sign-in and authenticationSign in with Google, a one time email link, or an email and password. Email links work once, only for their address, and expire after an hour. MFA and SAML SSO aren't available yet.
  5. Roles, permissions and row-level securityEvery member has one role per workspace, owner, admin, editor or viewer. Roles are enforced by row-level security policies in the database, so the rules hold for the app, AI features and server functions alike.
  6. Workspace isolationAll workspaces share one database, separated by row-level security on every table. You see a workspace only as a member, and content crosses over only through a deliberately shared library.
  7. Share links, embeds and revoking accessA share link opens one SOP, read only, to anyone who has it. Links can expire after 7 or 30 days or never, and can be revoked at any time. Embeds show the same SOP and stop working with their link.
  8. Files and storage accessFiles live in Supabase Storage. Only editors of a file's workspace can upload or delete. Imported PDFs are private, but images, screenshots and videos open for anyone with their random address.
  9. API key securityBusinessAPI keys are 256-bit random values shown once and stored only as SHA-256 hashes. Each key reaches one workspace, is read only or read and write, is limited to 60 requests a minute, and can be revoked instantly.
  10. Capture extension privacyThe extension records only while you capture, only in the tab you started in and tabs it opens. It never records what you type, masks password and card fields, and skips payment forms.
  11. Subprocessors and third partiesSOPCompass runs on Supabase and Vercel, uses Anthropic for AI and ElevenLabs for voice interviews, Resend for notification emails and Whop for billing. A few others are used only in specific cases.
  12. Data retention, deletion and exportContent is kept while your workspace is active, with fixed limits on some records. You can delete and export SOPs yourself; whole workspace or account deletion and full exports are by request.
  13. Backups and recoverySupabase keeps daily database backups for 7 days on our plan. Uploaded files aren't part of those backups. For everyday mistakes, each SOP's version history lets you restore an earlier version yourself.
  14. Compliance status, stated plainlySOPCompass isn't SOC 2 audited, ISO 27001 certified or HIPAA compliant, and doesn't sign BAAs. We describe the controls we do have, and our providers' certifications don't transfer to us.
  15. GDPR and CCPA basicsSOPCompass doesn't sell personal information or train AI on your content. Rights requests go to support@ironbridgeaiadvisory.com. Data is stored in the US, and we don't publish a standard DPA.
  16. How to report a security vulnerabilitySend suspected vulnerabilities privately to support@ironbridgeaiadvisory.com. Include steps to reproduce, don't access other people's data, and let us fix it before telling anyone. No paid bug bounty.
  17. Security questionnaire answersShort, honest answers to common security questionnaire items, each checked against the application code and our providers' documentation. Where the answer is no, it says no.