We treat customer data as sensitive by default. The controls below are enabled today; they are not certifications and do not eliminate the shared responsibility you retain over access, credentials, and content classification.
Encryption
- TLS 1.2+ for all traffic between browsers, the Service, and its subprocessors.
- Encryption at rest for the primary database, storage buckets, and backups.
- Application secrets stored in a managed secret store, never in source control.
Access controls
- Row-level security ensures accounts can only read and write their own data.
- Least-privilege administrative access with break-glass logging.
- Session tokens rotated regularly; suspicious sessions can be revoked.
Document storage
- Uploaded documents are stored in a per-account namespace and served via signed URLs.
- Access requires an authenticated session and passes the same row-level policies.
Application security
- Dependency scanning and automated tests run on every change.
- Server-only code paths kept out of the browser bundle by build-time protection.
- Input validation on both client and server for all mutating operations.
Backups & availability
- Managed database backups with point-in-time recovery.
- Immutable persisted reports — re-running an analysis produces a new report.
Incident response
If we determine that customer data was materially affected by a security incident, we will notify affected customers without undue delay and provide the information required to assess impact.
Report a vulnerability
- See the Responsible Disclosure page for scope and safe-harbor terms.
- Security contact: support@acquirelens.ai