Security you can check.

Where data goes, what runs on every change, and what we do not hold yet.

Compliance

The questionnaires procurement and security teams ask for. Send us yours and we answer it.

CAIQ v4
Cloud Security Alliance Consensus Assessment: the standard cloud-security questionnaire.
Not completed yet
SIG
Shared Assessments Standardized Information Gathering: the standard third-party risk set.
Not completed yet
HECVAT 4
Higher Education Community Vendor Assessment Toolkit, for university procurement and research offices.
Not completed yet

Product

Zero-retention

Every model call through our AI gateway requires a zero-retention provider, or it does not run: no training on your data, no retention by the provider.

WCAG 2.2 AA

Accessibility is tested in CI on every change, with axe-core against WCAG 2.2 AA.

Infrastructure

Onshore data plane

Our data plane runs in Australia: Postgres, auth and file storage in AWS Sydney. The register below names every third party outside it. This website runs on Vercel, a US company, with its functions in Sydney and a global edge network. Model calls go to model providers, all US companies, under zero-retention terms.

Row-level security

Isolation is enforced in the database, below the application, and tested by a harness on every CI run.

Operations

Scanned on every change

Static analysis and secret scanning: CodeQL, Semgrep, and gitleaks run on every pull request and every push to main.

The gates run in CI.

The checks pass or fail in CI: quality, isolation, supply-chain, and security gates, plus a tenant-isolation harness that writes its verdict to the database. You can check one claim here yourself: the isolation verdict on our status page. Our CI writes it, and that page reads it back.

Isolation verdict

Passing

7 tables checked, verified 13 hours ago

Isolation verdict

On our status page

-- Trust badge: founder/ops read; definer-only insert (the CI reporter); append-only.
create policy trust_select on public.trust_isolation_results for select to authenticated
  using ((select (auth.jwt() -> 'app_metadata' -> 'roles')) ?| array['founder', 'ops']);
create policy trust_definer_insert on public.trust_isolation_results for insert to postgres with check (true);
revoke insert, update, delete on public.trust_isolation_results from authenticated, anon;

Source:supabase/migrations/20260626090006_p6_compliance_dd_badge.sql, 26 June 2026

The register

Subprocessor	Purpose	Region
Supabase	Database, auth & storage	ap-southeast-2 (Sydney)
AWS	Infrastructure underlying Supabase	ap-southeast-2 (Sydney)
Vercel	Hosting, CDN and AI Gateway	Sydney functions, global edge
Anthropic	Claude models, zero data retention	US, and a region Vercel does not publish for Haiku
Amazon Bedrock	Claude models, zero data retention	US, EU (Frankfurt)
Claude Platform on AWS	Claude models, zero data retention	a region Vercel does not publish
Google Vertex AI	Claude models, zero data retention	US, EU
Microsoft Azure	Search embeddings with OpenAI’s text-embedding-3-small, zero data retention	a region Vercel does not publish
Stripe	Billing	US, global
Xero	Accounting and invoices	Australia, New Zealand, US, among others
Resend	Outbound email	US, sends from Tokyo
Google Workspace	Email for info@cogveralabs.ai	US, EU, global
Sentry	Error monitoring	US
Deepgram	Voice transcription	US

Updates

11 November 2026
Subprocessor register completed
The register gained Xero, Google Workspace, Vercel’s AI Gateway and four more zero-retention model providers the gateway may route to.
4 July 2026
Trust centre launched
Document library, subprocessor register, dated updates feed, and the responsible-disclosure route published at /trust and /.well-known/security.txt.
3 July 2026
Isolation badge made public
The RLS isolation harness result became publicly readable through a definer RPC (trust_badge_public). Live proof without a staff session.
27 June 2026
Public intake hardened
Marketing contact submissions moved to a SECURITY DEFINER intake RPC with per-IP rate limiting; the leads table has no anonymous write policy.

What we don’t claim yet

We hold neither SOC 2 nor ISO 27001. Both are on our roadmap. We have not yet delivered a client system into production, so everything on this page shows the standard we build to.

Spotted something? Tell us.

Found a vulnerability in anything we run? Email us directly. We acknowledge reports within three business days, keep you informed through to resolution, and credit good-faith research if you want the credit.

info@cogveralabs.ai

Send us your questionnaire

Send us the one your procurement team uses and we answer it. We hold no completed security questionnaire yet.