Trust & Security
Who operates SecurityAlert, how access is controlled, and what happens to investigation data.
Security review and procurement
Current assurance status: a signed SOC 2 audit engagement and a finalized customer Data Processing Addendum (DPA) are not currently in place.
Contact the owner to review your security requirements, available assurance documents and data-processing terms before purchasing. This page describes operating practices; it is not an independent audit report or a certification.
Hosting and recovery
- Primary hosting: the application and PostgreSQL database run on Microsoft Azure in Central US.
- Transport: public endpoints use HTTPS. The web server sends HTTP Strict Transport Security headers.
- Recovery: database backups are scheduled daily, with a scheduled weekly restore check. Copies use a rolling 30-day retention setting; expiration is applied during successful rotation.
- Credentials: runtime secrets are kept outside the public application directory with restricted operating-system permissions.
Authentication and workspace access
- Auth0 handles sign-in. API requests validate authentication and apply the caller's workspace membership and role.
- Company workspaces separate membership, investigation evidence and assigned work. Access checks apply to requests and database queries.
- Business API credentials can be revoked. Connected API and MCP tools receive the permitted workspace data under the account's access controls.
- Investigation decisions and corrective work retain their supporting evidence and history. Marking a task complete does not establish that a fix has been independently verified.
Website evidence and automated review
Website investigations can retain screenshots, extracted text, form destinations, redirects, observed phone numbers and comparison results. Public registration and exposure evidence can contain personal information. These records help explain a finding and support a review decision.
Anthropic and OpenAI APIs support automated review and report drafting. Relevant evidence can be sent to these services, including public-page content and images where the feature uses them. Review generated conclusions against the retained sources before acting.
The optional website beacon sends its installation key and the page's origin and permitted path. It omits query strings, fragments, cookies, referrers and form contents. Like other requests to the service, its network request can appear in security logs. You can pause or revoke the beacon.
Retention and deletion
Account deletion removes personal account records and access. It does not erase a shared workspace that other members still use, or independently collected public intelligence. Shared investigation records and work history can remain with that workspace. Closing a workspace is a separate operation and can require transferring ownership or resolving its subscription first.
Revoking an API key or pausing a website beacon stops future authorized use; it does not erase evidence already collected. Billing records and records subject to legal retention obligations may remain. Deleted data can remain in backups until the next successful rotation removes the relevant copy.
Vulnerability disclosure
We welcome responsible disclosure. Report vulnerabilities to security@securityalert.ai. We commit to acknowledging reports within 48 hours and a public advisory after remediation. Safe-harbour extended to good-faith research that avoids customer data access and does not degrade service.
Our security.txt is published at /.well-known/security.txt.
Incident transparency
We publish our own operational status at status.securityalert.ai and run a public changelog for all product changes. Security-relevant incidents affecting customer data are disclosed to affected customers within 72 hours.
Service providers and data sharing
| Provider | Purpose | Data involved |
|---|---|---|
| Microsoft Azure | Primary application, database and backup hosting in Central US. | Account, workspace and investigation records. |
| Auth0 / Okta | Sign-in and identity management. | Account identity and authentication information. |
| Stripe | Subscriptions and payments. | Billing identity, payment details and invoices. |
| Postmark | Transactional email and configured alerts. | Recipient addresses and message contents. |
| Twilio | SMS delivery when configured. | Recipient phone numbers and message contents. |
| Cloudflare | DNS and edge services. | DNS queries and network/request information for traffic it handles. |
| Anthropic and OpenAI | Automated finding review, investigation assistance and report drafting. | Relevant finding context, public-page content and images where the feature uses them, and investigation prompts. |
| Shodan, AbuseIPDB and Hudson Rock | Exposure, reputation and credential-exposure lookups when used. | Lookup targets such as IP addresses, domains or email addresses, depending on the feature. |
| Public intelligence and registration services | Certificate, DNS, registration, advisory, repository and app-store evidence collection. | The public lookup targets required by the source. |
| Destinations you configure | Delivery to Slack, Teams, webhooks or connected API/MCP tools. | The findings, asset context and messages delivered through that integration. |
Primary application hosting is in Azure Central US. Providers and connected destinations may process data in other locations under their own terms. Feature-specific recipients receive data when that feature runs; this includes scheduled collection and automated review.
Questions
Ask us about a specific control, an integration's data flow or your procurement requirements. We will distinguish the controls currently in use from any work still needed for your deployment.
Last updated: 9 October 2026