Trust Center

Unabated Products does not currently hold its own SOC 2 attestation. Our service runs entirely on SOC 2 Type II and ISO 27001 certified infrastructure (Supabase, Netlify, GitHub), so the underlying compute, storage, and network controls are independently audited. The data-handling, encryption, and access commitments below describe how we operate on top of that infrastructure.

• Customer-provided: name, work email, role/title, company name (optional), and in-product interaction transcripts.
• We do not collect or process payment card data (handled by Stripe), health data, biometric data, or children's data.
• Residency: all customer data is stored in US-East via Supabase (AWS us-east-1). No cross-region replication without a contractual amendment.

• Application: React + TypeScript SPA delivered via Netlify global CDN.
• Backend: Supabase managed Postgres + serverless edge functions.
• In transit: TLS 1.2+ (TLS 1.3 preferred) on all endpoints; HSTS enforced.
• At rest: AES-256 on Postgres volumes (Supabase platform), which maintains its own SOC 2 Type II report.
• Secrets: stored in Supabase Vault and Netlify environment variables; never committed to source control.

• Customer access: email-based authentication with JWT session tokens (Supabase Auth). Optional SAML SSO on enterprise tier.
• Internal access: all production access requires MFA, with quarterly access reviews. Service-role keys are scoped to specific edge functions.
• Row Level Security: Postgres RLS policies enforce per-tenant isolation. Customers cannot access another tenant's data even with valid credentials.

• Application logs: a production-safe logger sanitizes PII before write; debug logs are suppressed in production builds.
• Incident response: documented IR plan with customer notification within 72 hours of a confirmed material incident (consistent with GDPR Art. 33).
• Security contact: security@unabatedproducts.com (one business-day response SLA).

• Backups: daily automated Postgres backups via Supabase; point-in-time recovery enabled.
• Retention: 7 days minimum on standard tier; 30 days on enterprise tier.
• RTO: 4 hours (target). RPO: 24 hours (daily backup) or 1 minute (PITR).
• Disaster recovery: multi-AZ Postgres failover handled by the Supabase platform.

We use the following subprocessors to deliver our services. Each is reviewed annually for certification status, data residency, and breach-notification SLAs. We provide 30 days' advance notice of new subprocessors, with a right to object per the DPA.

• All code changes require pull-request review before merging to main.
• Dependency vulnerability scanning on every build (npm audit + Dependabot).
• Production deploys only from main via CI; no direct manual deploys.
• Third-party penetration testing (starting 2026 Q3).

• Export: customers can export their data in JSON/CSV via the in-product UI or by request.
• Deletion: account deletion removes all customer data within 30 days; backups purge within an additional 90 days.
• Subprocessor changes: 30 days' advance notice; right to object per the DPA.