Trust & Compliance
HoosAI’s security posture is published here so customers and auditors can verify what we do — not just take our word for it. Where a control is committed but not yet operating, this page says so rather than implying otherwise.
SOC 2 Type II
Readiness work is substantially complete and the audit is not yet closed. Controls are mapped to the AICPA Trust Services Criteria (Common Criteria plus the Privacy category), with a written policy and a named evidence path per control. Request the readiness package for the control matrix and current state per control.
GLBA Safeguards Rule (16 CFR §314.4)
For financial-institution tenants HoosAI operates as a §314.4(f) service provider. A Qualified Individual is designated, the written information security program (WISP) is published, and every database column holding non-public personal information is tagged and registered — enforced in continuous integration, so an untagged NPI-shaped column fails the build rather than relying on review.
Encryption and tenant isolation
- At rest: AES-256 (Postgres and file storage via Supabase)
- In transit: TLS 1.2+ enforced, with HSTS including subdomains and preload
- Row-Level Security is enabled on every table in the application schema, verified in continuous integration on every change — a new table without it fails the build
- Each tenant’s data lives in its own database project, not a shared table with a tenant column
Audit logging
Privileged actions write to an append-only audit table. Immutability is enforced by a database trigger rather than by permissions alone, so UPDATE and DELETE are refused even to the service role that bypasses row-level security.
Retention is a minimum of 365 days in the primary table. A copy-then-delete archival job moves older records to an equally immutable archive table, and is written so an interrupted run can duplicate a record but never lose one. Two things stated precisely: that job’s schedule is committed but not yet registered, and security telemetry — such as every use of the privileged database client — is recorded to a separate queryable log rather than the audit table, on a 90-day window.
Subprocessors
The complete list for National Narratives, not a summary: every vendor that receives data from this service, plus the platform-wide vendors that serve every customer. Each entry says what the vendor does and what class of data reaches it. Several receive no customer data at all — only a search string or a network candidate — and are listed anyway.
| Processor | Purpose | Data received | DPA |
|---|---|---|---|
| Supabase | Primary database, authentication and file storage | All customer data, including any regulated financial fields | Yes |
| Vercel | Application hosting and edge routing | Request and response data in transit | Yes |
| Anthropic | Claude model API — content generation, email extraction, meeting notes, transcript Q&A, and web searches it runs on our behalf | Prompt content, email bodies and meeting transcripts | Yes |
| Resend | Transactional email delivery | Email bodies and recipient addresses; for financial-services tenants these can include regulated identification fields | Yes |
| Doppler | Secrets management | Credentials only — no customer data | Yes |
| TypeformNational Narratives only | Public intake form embedded on one tenant's marketing page | Ordinary contact details submitted by the form's respondents | Yes |
| Google Gemini APINational Narratives only | Writes and voices the optional daily audio briefing (script generation and text-to-speech, returned to us as audio) | The briefing's subject name and short background, and the day's news summary text | No |
| StripeNational Narratives only | Subscription and credit-pack payments, invoices and the billing portal | Billing name and email, plan and payment records; card details are entered on Stripe's own checkout page and never reach us | No |
| Google Sign-InNational Narratives only | Optional "Sign in with Google" on the login page | Nothing from us beyond the sign-in request — Google acts as an independent controller of the user's own Google account data, and we receive only the identity claims needed to sign in (name and email address) | Not applicable |
| PodchaserNational Narratives only | Podcast, creator and episode search with audience data | A search query string and public podcast identifiers — no customer data | Not applicable |
| newsapi.ai / Event RegistryNational Narratives only | Media-article search for mention tracking and the daily brief | A search query string — no customer data | Not applicable |
Not currently processing data
Listed for completeness. Merging these into the table above would overstate what reaches third parties today; leaving them out entirely would hide a relationship you may have heard of.
- Podscan.fm — Retired — receives no data. Former podcast search provider, replaced by Podchaser.
- Builder.io Clips — Retired — receives no data. Former link offered when reporting a bug, for recording a screen clip; the link has been removed.
- Amazon Web Services — Selected, not yet serving any tenant. Application hosting — selected, migration in progress.
- Giphy — Retired — receives no data. Former GIF picker provider.
- Podcast Index — Retired — receives no data. Former podcast search provider.
- Discord — Retired — receives no data. Former internal notification webhook.
Periodic reassessment of each processor is required by our own program under §314.4(f); the register records the date of each vendor’s last review, and those dates are part of the readiness package rather than summarised here.
Penetration testing and vulnerability scanning
An annual external penetration test and semi-annual external vulnerability scans are committed in the WISP under §314.4(d), with the scope, the vendor-selection criteria and the evidence-storage layout published internally. To be precise about the current state: the cadence and criteria are defined, no engagement has been contracted yet, and we would rather say that here than imply a completed test.
Reporting a vulnerability
Email security@nationalnarratives.com with enough detail to reproduce the issue: the affected URL, the steps, and what an attacker could gain. We will confirm receipt. The same contact is published in machine-readable form at /.well-known/security.txt.
In scope
The web application on this domain, and the database, storage and API endpoints it calls on our behalf — including those hosted with our infrastructure providers — where the issue lies in our configuration, such as access policies.
Out of scope
Denial-of-service or load testing, social engineering of staff or customers, physical attacks, and vulnerabilities in a provider’s own platform rather than in our configuration of it (report those to the provider).
Safe harbor
We will not pursue action against good-faith research that avoids privacy violations, service degradation and access to data beyond what is needed to demonstrate the issue. Please give us reasonable time to fix an issue before disclosing it publicly.
Questions? trust@hoosai.biz