Trust & Compliance
HoosAI’s security posture is published here so customers and auditors can verify what we do — not just take our word for it. Where a control is committed but not yet operating, this page says so rather than implying otherwise.
SOC 2 Type II
Readiness work is substantially complete and the audit is not yet closed. Controls are mapped to the AICPA Trust Services Criteria (Common Criteria plus the Privacy category), with a written policy and a named evidence path per control. Request the readiness package for the control matrix and current state per control.
GLBA Safeguards Rule (16 CFR §314.4)
For financial-institution tenants HoosAI operates as a §314.4(f) service provider. A Qualified Individual is designated, the written information security program (WISP) is published, and every database column holding non-public personal information is tagged and registered — enforced in continuous integration, so an untagged NPI-shaped column fails the build rather than relying on review.
Encryption and tenant isolation
- At rest: AES-256 (Postgres via Supabase; per-tenant Cloudflare R2 bucket)
- In transit: TLS 1.2+ enforced, with HSTS including subdomains and preload
- Row-Level Security is enabled on every table in the application schema, verified in continuous integration on every change — a new table without it fails the build
- Each tenant’s data lives in its own database project, not a shared table with a tenant column
Audit logging
Privileged actions write to an append-only audit table. Immutability is enforced by a database trigger rather than by permissions alone, so UPDATE and DELETE are refused even to the service role that bypasses row-level security.
Retention is a minimum of 365 days in the primary table. A copy-then-delete archival job moves older records to an equally immutable archive table, and is written so an interrupted run can duplicate a record but never lose one. Two things stated precisely: that job’s schedule is committed but not yet registered, and security telemetry — such as every use of the privileged database client — is recorded to a separate queryable log rather than the audit table, on a 90-day window.
Subprocessors
The complete list, not a summary. Each entry says what the vendor does and what class of data reaches it. Several receive no customer data at all — only a search string or a network candidate — and are listed anyway.
| Processor | Purpose | Data received | DPA |
|---|---|---|---|
| Supabase | Primary database, authentication and file storage | All customer data, including any regulated financial fields | Yes |
| Cloudflare R2 | File storage — one isolated bucket per tenant | Any file a customer uploads, and its contents | Yes |
| Vercel | Application hosting and edge routing | Request and response data in transit | Yes |
| Anthropic | Claude model API — content generation, email extraction, meeting notes and transcript Q&A | Prompt content, email bodies and meeting transcripts | Yes |
| Resend | Transactional email delivery | Email bodies and recipient addresses; for financial-services tenants these can include regulated identification fields | Yes |
| Recall.ai | Meeting-recording bot for external calls, and calendar-based auto-join | Meeting audio, participant names and emails including external attendees, and calendar event metadata. Also custodies the connecting staff user's Google refresh token | Yes |
| Deepgram | Speech-to-text for meeting transcription | Meeting audio; transient processing, not used for model training | Yes |
| Google Workspace / Gmail | Email transport and, where enabled, inbound mailbox polling | Email bodies and addresses | Yes |
| Google Calendar OAuth | Consent and token exchange for staff who connect their calendar | The connecting staff user's own email address | Yes |
| Doppler | Secrets management | Credentials only — no customer data | Yes |
| Netlify | Static hosting for generated marketing microsites | Business-level company fields and generated static files — no personal or financial data | Yes |
| Smarsh Hosted Exchange (Intermedia)OneIndiana only | Reads and writes calendar appointments in the tenant's existing Exchange hosting | Calendar appointment data | Yes |
| TypeformNational Narratives only | Public intake form embedded on one tenant's marketing page | Ordinary contact details submitted by the form's respondents | Yes |
| Google Places API | Business discovery for the lead-research feature | An outbound search query (area and category) — no customer data | Not applicable |
| Podscan.fm | Podcast and episode search | A search query string — no customer data | Not applicable |
| NewsAPI.org | Media-article search for mention tracking | A search query string — no customer data | Not applicable |
| KLIPY | Optional GIF picker in chat, proxied through our server | The GIF search text a user types — no identifiers | Not applicable |
| Google STUN | WebRTC connection setup for voice channels | The browser's network candidates only — no audio and no content | Not applicable |
| Builder.io Clips | An outbound link offered when reporting a bug, for recording a screen clip | Nothing from us — this platform makes no call to it and receives nothing back except a link the reporter chooses to paste | Not applicable |
Not currently processing data
Listed for completeness. Merging these into the table above would overstate what reaches third parties today; leaving them out entirely would hide a relationship you may have heard of.
- newsapi.ai / Event Registry — Integrated, not yet processing data. Alternative media-article search, used only in demonstration environments.
- Fireflies.ai — Integrated, not yet processing data. Fetches a meeting transcript when a user supplies a transcript link.
- Microsoft Graph / Entra ID — Integrated, not yet processing data. Lets estimators send and reply to bid email as their own Outlook identity.
- Amazon Web Services — Selected, not yet serving any tenant. Application hosting — selected, migration in progress.
- Giphy — Retired — receives no data. Former GIF picker provider.
- Podcast Index — Retired — receives no data. Former podcast search provider.
- Discord — Retired — receives no data. Former internal notification webhook.
Periodic reassessment of each processor is required by our own program under §314.4(f); the register records the date of each vendor’s last review, and those dates are part of the readiness package rather than summarised here.
Penetration testing and vulnerability scanning
An annual external penetration test and semi-annual external vulnerability scans are committed in the WISP under §314.4(d), with the scope, the vendor-selection criteria and the evidence-storage layout published internally. To be precise about the current state: the cadence and criteria are defined, no engagement has been contracted yet, and we would rather say that here than imply a completed test.
Reporting a vulnerability
Email security@hoosai.biz with enough detail to reproduce. We will confirm receipt, and we will not pursue action against good-faith research that avoids privacy violations, service degradation and access to data beyond what is needed to demonstrate the issue.
Questions? trust@hoosai.biz