Built for counterparties that care about compliance.

Customer data is hosted on Supabase (AWS us-east-1 + eu-west-1 for EU customers on request). Data at rest is encrypted via AES-256. Connections are TLS 1.2+ only. Service-role keys are stored in Vercel environment variables, never in source.

Yes. Our security operating model lives in /security and is updated when material practices change. All employees and contractors sign a confidentiality + acceptable-use agreement before access. We do not yet hold SOC 2 Type II — we will not claim it until the audit report exists.

Affected members are notified within 72 hours of confirmed detection, matching the EU GDPR standard globally. Materially-impacted incidents trigger a public postmortem. See the Incident Response section below.

Customer-initiated deletion is processed within 30 days. Soft-deletes (via deleted_at timestamps) are the default to preserve audit-log integrity; hard-deletion of identifiable PII is performed on request via security@oilflow.us. Audit logs retain only the redacted hash of deleted entity names for compliance traceability.

No. Our AI subprocessor (Anthropic) is configured with a zero-retention DPA — customer data sent to the API is not stored, logged, or used for model training. This is contractually enforced.

Yes. Every customer-facing table has Postgres RLS enabled with FORCE ROW LEVEL SECURITY. Service-role queries are restricted to server-side routes; the anon key only has scoped read access. Every /api/v1/* route runs through withApiGate which scopes by auth.memberId.

Not currently. We use platform-managed keys via Supabase + Vercel. CMEK is on the roadmap for enterprise customers but is not available today. We're transparent about this rather than waving the question.

Database point-in-time recovery: 7 days (Supabase platform default). RPO: 5 minutes. RTO: 4 hours for full restoration. We do not currently maintain a multi-region active-active topology; cross-region failover is a manual DBA action.

Third-party penetration test scheduled for Q3 2026; engagement letter in progress with a CREST-accredited firm. Today we run self-conducted security review (static analysis + manual review, last pass 2026-05-31). Annual third-party cadence will commence with the Q3 engagement. Report available under NDA after completion at security@oilflow.us.

Yes. Researchers can submit findings to security@oilflow.us. We respond within 1 business day, fix valid criticals within 7 days, and publicly credit researchers on /security with their permission.

Yes. Production access is restricted to the on-call operator (Rafae) via 2FA + SSH key. Application-level access is gated by Supabase RLS + the ADMIN_USER_IDS allowlist for operator routes. No shared accounts.

Yes. Every /api/v1/* call writes a row to api_request_log with route, scope, response status, member_id, IP, and user-agent. Every admin action writes to admin_audit_log. Customers can export their own audit trail via /api/v1/audit.

New subprocessors require a DPA on file, a documented data-handling justification, and 30-day advance notice to customers of material additions. Current subprocessor list is published on this page and updated when changes ship.

Not yet. We're operating as a pre-SOC-2 startup and will not claim the certification until the audit completes. We have implemented controls that map to the SOC 2 Trust Services Criteria (security, availability, confidentiality) and can walk through the gaps with your auditors. Honest signal beats unsupported claim.

DPA: yes, template available at /dpa or via legal@oilflow.us. BAA: not currently — OilFlow does not process PHI and is not a HIPAA-covered entity. Counterparty health data should not be sent to our screening endpoints.

We notify the affected customer immediately unless legally prohibited (e.g. national-security order with a gag). We narrowly scope what we produce to what's compelled. Our government data-request policy is available from legal@oilflow.us.