Security questionnaire answers
Short, honest answers to common security questionnaire items, each checked against the application code and our providers' documentation. Where the answer is no, it says no.
This page collects the questions security reviewers ask most often. Every answer was checked against the SOPCompass application code, its database configuration, or our providers’ published documentation on the date above.
If your questionnaire asks something that isn’t covered here, email support@ironbridgeaiadvisory.com. We answer honestly, including when the answer is no.
Where to find more detail
| Topic | Article |
|---|---|
| Hosting, components and where rules are enforced | Security architecture overview |
| Region | Where your data is stored |
| Encryption | Encryption in transit and at rest |
| Sign-in | Sign-in and authentication |
| Roles and RLS | Roles, permissions and row-level security |
| Multi tenancy | Workspace isolation |
| Public links | Share links, embeds and revoking access |
| Files | Files and storage access |
| API | API key security |
| Browser extension | Capture extension privacy |
| Third parties | Subprocessors and third parties |
| Retention and deletion | Data retention, deletion and export |
| Backups | Backups and recovery |
| Certifications | Compliance status, stated plainly |
| Privacy law | GDPR and CCPA basics |
| AI | What data is sent to the AI and Is my data used to train AI models? |
Note: Our answers describe the product as it is today. If a control matters to your decision, ask us to confirm it in writing before you rely on it.
Common questions
Who provides SOPCompass?
SOPCompass, an Ironbridge AI Advisory company. Security contact is support@ironbridgeaiadvisory.com.
Where is the application hosted?
The app and server functions run on Vercel. The database, authentication and file storage run on Supabase in AWS region us-east-1 (Northern Virginia, United States).
Is SOPCompass single tenant or multi tenant?
Multi tenant. All workspaces share one Postgres database, separated by row-level security policies on every table.
How is access to customer data controlled within the application?
By Postgres row-level security. Every table in the app's public schema has RLS enabled, and policies check workspace membership and role on each row. The interface is never the only control.
What roles are available?
Owner, admin, editor and viewer, set per workspace. Only owners can grant the owner role, and a workspace can't lose its last owner.
Do you support SAML SSO or SCIM?
No. Sign-in is by Google, a one time email link, or email and password. SAML SSO and SCIM provisioning aren't available.
Do you support multi-factor authentication?
Not within SOPCompass. When users sign in with Google, their Google account's 2-step verification applies.
What is the password policy?
A minimum of 8 characters. Passwords are hashed and verified by Supabase Auth; SOPCompass never stores or sees them.
How long are sign-in and password reset links valid?
One hour, for one use, and only for the email address they were sent to.
Is data encrypted in transit?
Yes. The app is served over HTTPS with TLS 1.2 or 1.3 by Vercel, and Supabase states that customer data is encrypted in transit with TLS.
Is data encrypted at rest?
Yes, by Supabase, which states that all customer data is encrypted at rest with AES-256. There is no additional application level encryption, and customer managed keys aren't available.
Do you hold SOC 2, ISO 27001 or similar certifications?
No. SOPCompass has no SOC 2 report and no ISO 27001 certification. Our infrastructure provider Supabase states it is SOC 2 Type 2 compliant, but that doesn't extend to SOPCompass.
Are you HIPAA compliant, and will you sign a BAA?
No to both. Don't store protected health information in SOPCompass.
Do you have a recent third party penetration test report?
No. We don't have a penetration test report to share.
Do you offer an uptime SLA?
No.
What backups exist?
Supabase keeps daily database backups for 7 days on our plan. Uploaded files aren't included in those backups. We don't claim point in time recovery, and we don't commit to a recovery time or recovery point.
Which AI providers process customer data?
Anthropic (Claude, model claude-opus-5) for all text AI features, and ElevenLabs only for the optional voice interview. Transcription of uploaded recordings runs in the user's browser.
Is customer data used to train AI models?
SOPCompass doesn't train models. Anthropic's commercial terms say it may not train models on customer content. ElevenLabs' standard terms allow training unless the account opts out, so organizations that need a strict guarantee should use the typed interview instead of voice.
Does AI have access to all workspace data?
No. Each AI request is built with the requesting user's own permissions and includes only the content that feature needs. Nothing is sent to an AI provider unless someone uses an AI feature.
Can AI features be disabled?
Not with a setting today. Roles limit who can use each feature (viewers can use Ask only), and AI sort is limited to admins on the Business plan.
Who are your subprocessors?
Supabase, Vercel, Anthropic, Resend and Whop, plus ElevenLabs for voice interviews, Google for Google sign-in, Slack only for Send to Slack in SOPCompass's own internal workspaces (not offered in customer workspaces), and the Hugging Face CDN for downloading the in-browser transcription model. See the subprocessors page for details.
Where is payment data handled?
By Whop. Card details are entered on Whop's checkout and never reach SOPCompass, so SOPCompass is outside PCI DSS card data scope.
Can customers export their data?
Any SOP can be exported as Word or PDF, sign-off reports as CSV, and Business plan workspaces can read all SOPs through the REST API. A full workspace export is available on request.
Can customers delete their data?
Owners and admins can permanently delete archived SOPs and libraries in the app. Deleting a whole workspace or account is done on request by emailing support@ironbridgeaiadvisory.com. Database backups age out after 7 days.
Is there an audit trail?
There is an activity feed of changes such as SOP edits, moves, assignments and membership changes, per SOP version history, and an append only record of policy sign-offs. There is no exportable security audit log of sign-ins.
How are API keys protected?
Keys are 256-bit random values shown once and stored only as SHA-256 hashes. Each key is scoped to one workspace, read only or read and write, limited to 60 requests a minute, refused if sent in a URL, and revocable at any time by owners and admins.
Can the application be framed by another site?
Only embed pages (/embed/...) can be framed. Every other page sends X-Frame-Options DENY and frame-ancestors 'none'.
Who at SOPCompass can access customer data?
Only the people who operate the service, through administrative access to the Supabase and Vercel projects. There is no application level encryption that would prevent an administrator from reading content.
How do we report a vulnerability?
Email support@ironbridgeaiadvisory.com with Security in the subject line. There is no paid bug bounty.