Trust and security
What is in place, and what is not yet
Every statement here is checked against the code, a configuration, a record or the vendor's own page, and carries its status. Anything we have not done says Not yet.
At a glance
Last verified 2026-10-15
- SOC 2 is not started. We are preparing the controls an auditor would check.In place
- No third-party penetration test has been run yet.In place
- The production database is backed up by Supabase, and a restore was tested on 2026-10-12.In place
- Two-factor authentication is available to every user.In place
- Customer data is hosted by Supabase and Vercel in the United States (us-east-1).In place
Data protection
Last verified 2026-10-27
- Point-in-time recoveryNot yet
- Connections to your accounting system are read only.In place
- All connections use TLS.In place
- Supabase states that data at rest is encrypted; see Supabase's security page.In place
- Data exported as CSV is protected against spreadsheet formula injection.In place
Access
Last verified 2026-10-15
- Two-factor required for ownersNot yet
- A rep sees only the accounts assigned to them.In place
The free check
Last verified 2026-10-15
- The free check reads your file in your own browser. The file is never uploaded, and you can confirm this in the browser's network tab.In place
AI and models
Last verified 2026-10-30
- Allodial uses Anthropic's Claude models for the Allo assistant.In place
- Anthropic's commercial terms state that Anthropic may not train models on customer content from its services; see Anthropic's Commercial Terms of Service.In place
- Anthropic states that it deletes API inputs and outputs within 30 days, unless a longer period is agreed, is needed to enforce its usage policy, or is required by law.In place
- Zero data retention with the model vendorNot yet
- Drafts written with help from a model are labelled, and the product never sends them. A person copies and sends them.In place
- A model never decides which accounts are flagged. Detection is deterministic arithmetic over order history.In place
How we build
Last verified 2026-10-27
- Database changes are versioned migrations, applied by hand after a verified backup, and every release is promoted to production by hand.In place
Your data
Last verified 2026-10-15
- Full data exportNot yet
- Deletion on requestNot yet
- Allo conversations are kept for 90 days.In progress
Process
Last verified 2026-10-15
- We have an incident response plan that covers how incidents are handled and how customers are notified.In progress
- Our security policies are available on request under NDA.In progress
- Public status pageNot yet
Shared responsibility
Last verified 2026-10-27
- Allodial is responsible for its own code, who can reach your data inside the product, its written policies, and its people.In place
- Our hosting vendors are responsible for the physical security of their data centers, the encryption of their infrastructure, and their own certifications, which are their statements, not ours.In place
- You are responsible for who you invite and the role you give them, your users' passwords and second factor, the files you upload, and access to your own accounting or ERP system.In place
Subprocessors
Generated from our vendor register. A vendor's certifications are its own statement, not ours.
| Vendor | Purpose | Data it receives | Location | Its statement |
|---|---|---|---|---|
| Supabase | Database, authentication, and file storage for the application. | Customer-confidential, Personal (this is the primary data store). | United States, AWS us-east-1 (per Supabase project settings). | Supabase states data at rest is encrypted and the platform is SOC 2 Type II. See https://supabase.com/security |
| Vercel | Hosting and serverless functions for the app and the marketing site. | Customer-confidential, Personal (processed in transit by the functions); Telemetry. | United States, iad1 (us-east-1). | Vercel states it is SOC 2 Type II and encrypts data in transit. See https://vercel.com/security |
| Anthropic | Claude models for the Allo assistant. | Operational (the person's chat messages and the context Allo's tools read for them under their own access, such as account names and account summaries). Not order history in bulk. | United States (Anthropic states data is stored in the US; by default it may route traffic for processing to select countries in the US, Europe, Asia and Australia). | Anthropic's Commercial Terms state that Anthropic may not train models on customer content from its services, and Anthropic states that it deletes API inputs and outputs within 30 days unless a longer period is agreed, needed to enforce its usage policy, or required by law. See https://www.anthropic.com/legal/commercial-terms and https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data |
| Resend | Transactional email (invites, resets, digests, notifications). | Personal (recipient email addresses and message content). | United States. | Resend states it is SOC 2 Type II. See https://resend.com/security |
| Sentry | Error and performance monitoring. | Telemetry (errors and traces). Cookies and request bodies are dropped before send; see sentry.server.config.ts. | United States (per Sentry project settings). | Sentry states it is SOC 2 Type II. See https://sentry.io/security/ |
| Upstash | Redis for rate limiting. Fails open when unset. | Operational (rate-limit keys derived from email and IP). No order data. | United States (per Upstash database region). | Upstash states that Redis databases on its Pro and Enterprise plans are SOC 2 compliant (read 2026-10-27; which Upstash plan Allodial is on is [OWNER] to confirm). See https://upstash.com/docs/common/help/compliance and https://trust.upstash.com |
| Klaviyo | Marketing email and the newsletter list. Not used for transactional product mail. | Personal (newsletter subscriber email addresses). No order data. | United States. | Klaviyo states it undergoes annual third-party audits against standards such as SOC 2 and ISO 27001 (read 2026-10-27). See https://www.klaviyo.com/trust |
| Google sign-in (OAuth). Optional sign-in method. | Personal (verified email and profile name for the signing-in user). | United States. | Google states its platform is independently audited for SOC 2 and ISO 27001. See https://cloud.google.com/security/compliance | |
| Intuit (QuickBooks Online) | A customer-initiated, read-only data source for order history. The customer connects it; Allodial reads. | Customer-confidential (order history from the customer's own QuickBooks). Read only. | United States. | Intuit states QuickBooks Online is SOC 2 and the connection uses OAuth with read scopes. See https://security.intuit.com/ |
| Geocodio | Address lookup (geocoding) for the visit planner (Prompt 5A F19). NOT ENABLED: the visit planner is off at the platform switch and no key is set. Before it is enabled the owner signs up, sets GEOCODIO_API_KEY, and Geocodio is added to the subprocessor tables on /trust and /privacy. | Operational (the street address, city, state and postal code of an account a rep is due to visit). Nothing else: no account name, no order data, no contact details. Each address is sent at most once; the answer is cached in geocode_cache. | United States (per Geocodio). | Geocodio states it does not store or resell submitted addresses beyond processing the request. See https://www.geocod.io/privacy/ |
Documents on request
- Our answers to a standard security questionnaire are available on request.In place
Tell us your company, your email and what the document is for, and we send it.
Changes to this page
- 2026-10-27 Rebuilt from the claims file. Every statement now carries its proof, verification date and status, and a statement whose proof is missing or older than 90 days is not shown. Vulnerability reports go to support@ until the security@ mailbox is confirmed. Release and build claims reworded to what the workflow files prove.