What we do today to protect your documents, what we do not do yet, and when each statement was last reviewed (2026-10-10).
TLS in transit; AES-256 at rest, managed by our hosting providers. Not end-to-end: documents are processed on our servers and by our AI provider (OpenAI).
You can ask us to access, export or delete your data. We do not claim GDPR certification; the status of our data-protection work is listed under Compliance below.
Hosted on Vercel and Supabase, which publish their own SOC 2 Type II reports. Understify itself holds no SOC 2 report and offers no uptime SLA yet.
Role-based access control (RBAC) for organisation workspaces: viewers are read-only; owners, admins and editors can approve. Decision approvals and actions are logged.
Row-level security policies in the database scope each record to its owner or organisation. Documents are shared only when you share them.
No independent penetration test has been completed yet. One is planned before public launch.
Team plans add shared workspaces with role-based permissions for who can view, edit and approve.
Database backups are run by our database provider (Supabase). We have not yet completed a timed restore drill; we will publish tested recovery times once we have.
Row-level security on every table
Encryption at rest (provider-managed)
Understify does not hold a SOC 2 report or any other security certification. We will describe SOC 2 as "in progress" only once an audit firm is engaged, and we will date that statement. Our hosting providers (Supabase and Vercel) publish their own SOC 2 Type II reports; that is their assurance, not ours.
At Understify, security is fundamental to everything we do. We implement multiple layers of protection to keep your documents private and accessible only to you and the people you share them with. Each statement below is something we do today unless it is marked as planned.
Data is encrypted in transit with TLS and at rest by our hosting providers (AES-256, provider-managed keys). Documents are decrypted on our servers for analysis, so this is not end-to-end encryption.
Documents and records are stored with Supabase (database and file storage). Our hosting providers publish their own SOC 2 Type II reports; that is their assurance, not an Understify certification.
Row-level security is enabled on every application table, and organisation roles (owner, admin, editor, viewer) control who can view, approve and manage.
Status: planned. No independent penetration test or external security audit has been completed yet. We will publish a summary here once one is done.
Data sent between your device and our servers is encrypted with TLS. Documents are decrypted on our servers to be analysed and are sent to our AI provider (OpenAI) over TLS, so we do not describe this as end-to-end encryption.
Stored documents and database records are encrypted at rest (AES-256) by our hosting providers, who manage the keys. We do not yet add our own application-level encryption on top.
We run on Vercel (application) and Supabase (database and file storage). These providers publish their own SOC 2 Type II reports. Today that means:
Row-level security is enabled on every application table, and its policies scope each record to its owner or organisation. Documents are shared only when you add teammates to a workspace or create a share link.
Sign-in is handled by Supabase Auth (email and password, or Google). Supabase stores passwords as bcrypt hashes, never in plain text. Multi-factor authentication (MFA) is not available yet; it is planned.
Access to your documents is controlled by row-level security and organisation roles (RBAC). Only you can access your documents unless you share them with a team workspace or a share link.
Application errors are reported to our error-monitoring provider (Sentry), and decision approvals and actions are recorded in an audit log. We do not yet run 24/7 security monitoring.
Status of each item, last reviewed 2026-10-10. Understify holds no certification or attestation.
Partial. You can request access, export and deletion of your data. We do not claim GDPR compliance or certification; a full account-data purge and a published subprocessor list are still being completed.
Not started. No SOC 2 audit firm is engaged and no report is held. Our hosting providers hold their own reports.
Not assessed. We have not completed a CCPA assessment.
If you discover a security vulnerability, please report it responsibly. We appreciate your help in keeping Understify secure.
Please email security concerns to: security@understify.com
Contact us for security documentation, questionnaires or questions about any claim on this page.