1. Data at rest
- Customer-provided LLM API keys: AES-256-GCM encryption with a per-key random nonce, stored in PostgreSQL
modelstable columns (ciphertext, nonce, kid). Plaintext keys are never written to disk, logs, or audit records. - Database: Supabase Postgres (
ap-southeast-1), AES-256 disk encryption by the cloud provider, automated backups with 7-day Point-in-Time Recovery. - Storage bucket: Supabase Storage
reportsbucket (private), accessed via signed URLs only.
2. Data in transit
- TLS 1.3 minimum on all external endpoints (orchestrator API, web app)
- Internal service-to-service traffic on Railway private networking
- Postgres connections via Supavisor pooler with mandatory TLS
3. Access control
- User authentication: Supabase Auth (HS256 JWT signed with project secret).
- Application-layer scope guard: every API route enforces customer_id matching against the authenticated user's tenant.
- Database-layer Row-Level Security (RLS): enabled on 10 tenant tables (customers, users, models, jobs, qe_runs, metrics, reports, ql_reviews, evidence_docs, controls). Service-role bypasses RLS for orchestrator operations; all other roles are tenant-scoped.
- Internal access: AgentSure personnel access is tied to individual SSO identities (work email + 2FA), with least-privilege role assignment.
4. Audit logging
Every write to tenant tables triggers an audit_log entry capturing actor, action, entity, and detail. The table is protected by a Postgres trigger that rejects UPDATE / DELETE / TRUNCATE, making the log append-only. Targeted retention is 7 years (subject to legal-hold requirements).
5. Report integrity
- Every Assessment Report is hashed with SHA-256 at render time. The digest is stored in
reports.signed_hashand shipped in theX-AgentSure-Signed-Hashresponse header. - Share-token URLs are HS256 JWTs signed with a dedicated secret (separate key space from Supabase Auth). Tokens carry a configurable TTL (60 s – 7 d) and an audience claim that prevents reuse.
6. Customer-provided API credentials
When a customer provides API credentials for adversarial testing, we enforce:
- Credentials stored encrypted at rest as described in §1
- Plaintext exists only in the worker process memory during the active Assessment
- Customer must configure a spend cap of ≤ USD 500 on the provider account
- Customer must rotate credentials within 7 days post-Assessment
- Customer remains liable for all usage charges on their provider account
7. Incident response
- Notification window: 24 hours from awareness, to give customers time to make their own 72-hour PDPC notification (PDPA s.26D) or GDPR Article 33 notification.
- Monitoring: Sentry for application errors, BetterStack for service health, Supabase Logs for database activity, PostHog for usage anomalies.
- Runbook: documented internally (RACI matrix + escalation tree). Available under NDA to Underwrite customers.
8. Data residency
We default to Singapore data residency:
- Supabase Postgres + Storage:
ap-southeast-1 - Vercel edge: SG / HKG regions
- Railway compute: SG region migration in progress (currently US-East — see Subprocessors for status)
- Customer-elected LLM endpoints: customer's choice
9. Compliance roadmap
- 2026-Q3: Internal SOC 2 readiness assessment
- 2026-Q4: SOC 2 Type I report (3-month observation window)
- 2027-Q3: SOC 2 Type II report (12-month observation)
- 2027-Q4: ISO 27001 certification process
- 2028-Q2: ISO 42001 (AI Management System) — once stable certification body emerges
10. Coordinated vulnerability disclosure
We welcome security research. To report a vulnerability, please email security@agentsure.tech with reproducible steps. We aim to acknowledge within 2 business days and remediate critical issues within 30 days. Bug bounty programme is not currently active.
11. Questions
For security questionnaires (SIG-Lite, CAIQ, custom), contact security@agentsure.tech. We can usually respond to standard questionnaires within 5 business days.