Compliance status, stated plainly
SOPCompass isn't SOC 2 audited, ISO 27001 certified or HIPAA compliant, and doesn't sign BAAs. We describe the controls we do have, and our providers' certifications don't transfer to us.
On this page
We would rather lose a deal than overstate our security. This is where SOPCompass stands today.
What SOPCompass does not have
- SOC 2. No SOC 2 Type I or Type II audit or report.
- ISO 27001. Not certified.
- HIPAA. Not HIPAA compliant, and we don’t sign Business Associate Agreements.
- PCI DSS. SOPCompass never handles card data. Payments go through Whop.
- GDPR certification. There is no official GDPR certification, and we don’t claim one. See GDPR and CCPA.
- An independent penetration test that we can share.
- An uptime SLA.
- A standard Data Processing Agreement published on our site.
What we do have
These are controls in the product, described in this section:
- Row-level security on every table in the app’s database, so access rules are enforced by the database, not the interface.
- Roles for owners, admins, editors and viewers, with database guard rails such as a protected last owner.
- Workspace isolation, with probe scripts that check a viewer and an anonymous visitor can’t reach other workspaces.
- Share links that expire and can be revoked, read through a single database function.
- API keys stored only as SHA-256 hashes, scoped, rate limited and revocable.
- Encryption in transit and at rest, as provided by Vercel and Supabase.
- Version history and archive before delete.
- An append only record of policy sign-offs.
- A published list of subprocessors.
- AI providers used under terms that don’t allow training on your content, with the voice interview’s different terms stated openly.
What our providers hold
Supabase states that it is SOC 2 Type 2 compliant and HIPAA compliant (HIPAA with a signed BAA on eligible plans). Vercel publishes its own compliance information. These cover the providers’ infrastructure and controls. They don’t make SOPCompass compliant.
What not to store in SOPCompass
- Protected health information (PHI)
- Payment card numbers or bank account details
- Government ID numbers, such as Social Security numbers
- Passwords, API keys or other credentials
- Any data a law or contract says must be stored in a certified system
Questions
If your organization has a security questionnaire, start with our security questionnaire answers, then email support@ironbridgeaiadvisory.com for anything else. We will give you straight answers.
Common questions
Is SOPCompass SOC 2 compliant?
No. SOPCompass has not been audited for SOC 2 Type I or Type II and has no SOC 2 report.
Is SOPCompass HIPAA compliant? Will you sign a BAA?
No, and no. Don't store protected health information in SOPCompass.
Supabase is SOC 2 compliant. Doesn't that make SOPCompass compliant?
No. A provider's certification covers the provider's own controls. It doesn't certify the application built on top of it.