Security
How this is built and run
This page exists for the person whose job is to evaluate us before an institution signs anything. Every claim on it is verifiable, and the things we have not done yet are listed with the same directness as the things we have.
Architecture, in one paragraph
Standing Proof is a server-rendered web application. The browser never talks to the database: every read and write goes through application code running on the server, which enforces ownership on each query. The database additionally has row-level security enabled on all 38 application tables with zero permissive policies: deny-by-default at the database’s own API layer, verified on both of our environments. There is no public API.
Tenant isolation
Every record carries its owner. Application queries filter on the authenticated user’s identity, and collaborator access (where a user invites a résumé professional into scoped parts of their evidence) passes through a single authorization chokepoint that returns not-found for anything outside an explicit, revocable, per-record grant. What has not been shared is never listed, previewed, or counted to the other party.
Authentication
Sign-in is by emailed one-time code or magic link through Supabase Auth. There are no passwords, which means there is no password database to breach, reuse, or phish against. Sessions are cookie-based and server-verified on every request.
Encryption
Traffic is TLS in transit. Data is encrypted at rest by the database provider (Supabase, AES-256), a provider guarantee that applies to every project on the platform, stated here as exactly that rather than as a control we operate ourselves.
Data residency
All application data lives in the United States: the database in AWS us-east-2 (Ohio), application hosting on Vercel with its primary region in US East. AI analysis calls are processed by Anthropic in the United States. No data is stored outside the US.
Subprocessors
Four, and the list is short on purpose. Each one exists because it does something we should not build ourselves.
| Provider | Role | What it processes | Region |
|---|---|---|---|
| Supabase | Database hosting and authentication | All application data at rest; sign-in email addresses | United States (AWS us-east-2, Ohio) |
| Vercel | Application hosting and delivery | Data in transit through the application; request logs | United States (primary region US East) |
| Anthropic | AI analysis, only when a user invokes it | The specific posting or records sent for that one analysis; API data is not used to train models | United States |
| Stripe | Subscription billing | Payment details (never sent to or stored by us); subscription status | United States |
AI calls carry only what that one analysis needs, a job posting or the records a user chose to have read, and never the whole account, and users can mark any record as excluded from AI entirely. Anthropic does not train models on API data.
Retention and deletion
Data is kept while an account exists and deleted when the account is deleted: self-service, from Settings, no email required. The one record that survives is an anonymized audit note that a staff member performed an action, kept because an audit trail that can be deleted is not one. The full detail, including what happens to collaborator access on deletion, is in the privacy policy.
Internal access
Production access is limited to the founder. Staff support tooling operates through the application with every mutation written to an audit trail (who, what, when) rather than through direct database access.
What is not in place yet
No SOC 2, no third-party penetration test, no formal SLA. If your procurement requires any of these today, we are not the right tool yet, and we would rather say so here than midway through your review. Each sits on a staged readiness roadmap with explicit triggers: certification follows the first engagements that require it, and we will not claim it in advance.
Data processing agreement
A standard DPA covering the subprocessors and measures on this page is available on request for institutional engagements. Aggregate-only cohort reporting, where programs see counts and never participant records, is described on the data & trust page.
Questions a reviewer needs answered: privacy@standingproof.com.