Security at PolicyAlign
You upload your security policies to us — so you deserve to know exactly how we treat them. In plain language, with nothing glossed over.
Your documents are visible only to your organization
Every record in PolicyAlign is tagged with your organization's ID, and database-level rules (PostgreSQL row-level security) enforce that members of your organization can only ever read your organization's rows. This isn't an application-code check that a bug could skip — the database itself refuses cross-tenant reads. Uploaded files live in a private storage bucket under a per-organization folder with the same enforcement.
Encryption everywhere
Documents and data are encrypted in transit (TLS 1.2+) and at rest (AES-256) — at rest encryption is provided by our infrastructure providers (Supabase for database and file storage, Vercel for hosting). Browser sessions use secure, SameSite cookies.
How AI analysis works — and what the AI provider sees
Analysis runs on Anthropic's Claude API. Document text is sent to the API solely to produce your control mappings, and per Anthropic's commercial API terms, API inputs and outputs are not used to train their models. We never sell, share, or use your documents for anything other than generating your own report.
Sign-in protections
- Passwords are handled by Supabase Auth (bcrypt-hashed, never stored readable)
- Two-factor authentication (TOTP) available to every account
- Generic error messages — sign-in and reset flows never reveal whether an email is registered
- Rate limiting on sign-in, sign-up, reset, and upload endpoints
- Every login, upload, and report view is written to your organization's own activity log
Retention and deletion
Your documents and reports remain yours. We deliberately keep as little as possible: if you cancel, your uploaded documents are deleted from storage within 14 days (your downloaded reports are unaffected — they're yours forever). You can request earlier deletion or a full export at any time, and deletion requests are honored within 14 days.
What we don't claim
We are a small product and we'd rather under-promise: PolicyAlign does not yet hold a SOC 2 attestation or external penetration test — those are planned as the customer base grows. What you read on this page is the actual architecture, and our scoring is fully documented on the methodology page. Questions? Ask — security questions get straight answers.