Security
Australian data residency, by default.
Customer data at rest stays in Sydney. Tenants are isolated at the database layer. Application controls are backed by code, not slides.
Where data lives
The stack, in four numbers
01 · Residency
Australian data residency
Customer data at rest (transcripts, flow definitions, configuration, embeddings, audit logs) lives in Supabase Postgres on AWS ap-southeast-2 (Sydney).
Voice compute runs on Fly.io Sydney. The web app is served via Vercel's global edge for static assets only; no customer data is stored at the edge.
02 · Encryption
Encryption in transit and at rest
TLS 1.2 or higher in transit on every leg: caller, WebRTC transport, pipeline, and downstream LLM, STT, and TTS providers. AES-256 at rest on Supabase, the default for managed Postgres.
Secrets are managed via the Vercel and Fly.io secret stores, never checked into source control.
03 · Isolation
Tenant isolation via RLS
Every customer row in the database carries a workspace_id and a Supabase Row-Level Security policy scoped via user_workspace_ids(). Reads and writes resolve to the authenticated workspace.
The service-role client, which bypasses RLS, is restricted to server-side webhook and admin paths and gated by inline justifications.
04 · Providers
Provider data handling
LLM, STT, and TTS calls go to vendor APIs over TLS: Anthropic for the model, Deepgram for speech recognition, Cartesia for synthesis, Daily for WebRTC, and Twilio for inbound phone routing. Vendor agreements forbid training on customer input by default.
Anthropic retains API inputs and outputs for up to 30 days for trust and safety review under their standard terms. We will publish zero-retention enrolment when our enterprise tier qualifies. Until then, treat any field that flows into a prompt as logged at the provider for that window.
05 · Retention
Configurable retention and append-only audit
Per-org retention windows of 30, 90, 365, or 730 days (default 365) purge conversation transcripts and session events automatically via a daily scheduled job. Enterprise contracts can opt out.
The audit_logs table is append-only with no UPDATE or DELETE policy. It records actor, action, resource, and before / after snapshots for billing, membership, and configuration changes.
Submit a deletion request from your account and we hard-delete personal data within 7 days, well inside the 30-day window required by the Australian Privacy Act and GDPR Article 17.
06 · Compliance
Compliant where self-attestation is the standard
Compliant with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (self-attested). PCI DSS SAQ-A self-assessed annually. The Notifiable Data Breaches notification process is documented and rehearsed. GDPR Article 28 alignment via standard DPA, published sub-processor list, and self-serve data subject endpoints.
SOC 2 Trust Services Criteria controls implemented and mapped; independent audit has not yet been completed. ISO/IEC 27001:2022 Annex A controls aligned; certification follows the same audit cadence. HIPAA and IRAP are not in scope today.
07 · Application security controls
Controls backed by code, not slides
HSTS preload header
Strict-Transport-Security with preload, includeSubDomains, and a two-year max-age. Browsers refuse plaintext for the apex.
Origin guard on writes
checkSameOrigin() rejects cross-site POST, PATCH, and DELETE on every billing and organisation route, layered on top of SameSite=Lax cookies.
Stripe signature plus idempotency
Raw-body signature verification on every Stripe webhook. Accepted event IDs are recorded in stripe_webhook_events; replays short-circuit.
Sentry PII scrubbing
Request bodies on billing, webhook, and auth routes are stripped before send. Cookie, authorization, and stripe-signature headers are redacted on every event.
PII redaction at persistence
Every transcript line is masked for credit cards (Luhn), Australian TFNs and Medicare, and US SSNs before it reaches the database.
Configurable per-org windows
30, 90, 365, or 730-day retention runs daily via a scheduled Postgres job. Conversation messages and session events past the window are purged automatically.
Per-IP throttling on billing
Billing portal, subscription, and usage routes are capped at 10 requests per minute per IP. Account export and deletion are tighter still.
Append-only audit log
audit_logs has no UPDATE or DELETE policy. Billing, membership, and configuration changes are written once with actor, action, resource, and diff.
RLS on every customer table
Row-Level Security policies scoped via user_workspace_ids() apply to every table that holds customer data. Cross-tenant reads are a schema impossibility.
Hardened response headers
X-Content-Type-Options nosniff, X-Frame-Options DENY, COOP same-origin, Referrer-Policy strict-origin-when-cross-origin, and a tight Permissions-Policy.
Encrypted secret stores
All credentials live in Vercel and Fly.io secret stores. Service-role keys are server-only and gated by an inline justification on import.
Self-serve export and erasure
Email privacy@verticalai.com.au to request a data export or account deletion. Requests enter a queue with a 7-day operational SLA. Self-serve export and erasure from inside the app are rolling out shortly.
08 · Compliance frameworks
Per-framework status, no marketing varnish
PCI DSS SAQ-A
Card data never touches our servers. Stripe Checkout and Customer Portal handle the full PCI scope; we hold only opaque Stripe IDs. SAQ-A is the standard mechanism for merchants who fully outsource cardholder data.
Privacy Act 1988 (Cth) + 13 APPs
Compliant. No external certification body exists for the APPs; the OAIC publishes a self-assessment tool. Reviewed against our practices annually.
Notifiable Data Breaches scheme
72-hour notification process. Incident runbook rotates Stripe and Supabase credentials, audits the affected window via the audit log, and produces a written notice to affected individuals and the OAIC.
GDPR (Art 28 processor)
Aligned. Standard DPA, published sub-processor list, self-serve data export and erasure endpoints. No EU establishment; data subject obligations honoured for EU customers.
SOC 2 Type II
Trust Services Criteria controls implemented and mapped. Independent audit not yet completed. Engagement with Vanta or Drata begins on first enterprise contract demand.
ISO/IEC 27001:2022
Annex A controls aligned (70% overlap with SOC 2). Certification will follow the same audit cadence. Relevant for EU and UK expansion under NIS2.
Essential Eight (ASD)
Six of eight controls fully met within cloud-native scope, one partially met (quarterly restore drills), one not applicable (Office macros). Per-control evidence on request.
HIPAA · IRAP · APRA CPS 234
HIPAA requires sub-processor BAAs (roadmap, enterprise tier). IRAP applies only to Australian government workloads. APRA CPS 234 designed-for, formal alignment on request for APRA-regulated customers.
FAQ
The questions procurement always asks
Transcripts, flow definitions, analytics, embeddings, and audit logs all live in Supabase Postgres on AWS ap-southeast-2 (Sydney). Voice compute runs on Fly.io Sydney. Static assets are served via Vercel's edge network; no customer data is stored at the edge.
No. Voice is processed in real time. We persist text transcripts of conversations, not audio files. Daily handles WebRTC media in transit only.
We do not train models on customer data. Model and speech vendors (Anthropic, Deepgram, Cartesia) contractually do not train on input sent through their APIs. Anthropic retains API inputs and outputs for up to 30 days for trust and safety review under their standard terms; zero-retention enrolment is on the enterprise roadmap.
Transcripts are stored under the same Row-Level Security isolation as the rest of the database; only members of your organisation can read them. Before persistence, every transcript line passes through a redactor that masks credit card numbers (Luhn-validated), Australian Tax File Numbers, Medicare numbers, and US Social Security numbers.
Not yet. SOC 2 Trust Services Criteria controls are implemented and mapped against our environment (access review, change management, incident response, vendor review, audit logging, encryption). The independent audit has not been completed. We engage Vanta or Drata once the first enterprise contract triggers it. ISO 27001 follows the same cadence; HIPAA and IRAP are out of scope today.
Mapped. Six of the eight controls are fully met within our cloud-native scope: Application Control via managed platforms, Patch Applications via Dependabot, Restrict Administrative Privileges via RLS and service-role discipline, Patch Operating Systems delegated to Vercel/Fly/Supabase, Multi-factor Authentication on infra surfaces plus end-user TOTP enrolment in account settings, and User Application Hardening via response headers. One control is partially met — backup restoration drills are documented but the quarterly cadence is still ramping up. One does not apply (Microsoft Office Macros). We do not publicly claim ML1 as a whole until the restoration drills are on cadence.
Yes. Our standard DPA covers GDPR Article 28 and APP 8 obligations and handles most SMB and mid-market deals. Email legal@verticalai.com.au with your entity name. Custom DPAs are available for regulated entities (healthcare, finance, super) on request.
Need the paperwork?
We send DPAs and evidence packages to Australian buyers every week. Tell us the shape you need.