Trust Center

How we protect your deal.

Sifrsys is a virtual data room built for the most confidentiality-sensitive transactions. This page sets out our security posture: what is in place today, who operates the service, and the documentation we share for a vendor review.

For a deeper technical walk-through, see our security overview.

Compliance & certifications

Area	Status	Detail
SOC 2 Type II	Readiness	Controls built and mapped. Roadmap available on request.
Encryption at rest	In place	AES-256 on all stored data (Supabase / AWS KMS).
Encryption in transit	In place	TLS 1.3 on all connections.
Tamper-evident audit log	In place	SHA-256 hash-chained, verified on a schedule.
AI data handling	In place	Permission-fenced at the database level; zero provider retention; never used for model training.
GDPR / DPA	DPA available on request	Data Processing Agreement with Standard Contractual Clauses, available for your vendor review.

Security architecture

Database-enforced isolation. Every tenant's data is separated by Row-Level Security in the database, not just in application code — so a bug in the app cannot cross the boundary.
Permission-fenced AI. The AI can only retrieve what the asking participant is authorized to see; the same database rules that protect documents protect the AI's answers.
Tamper-evident audit log. Every access and permission change is written to a SHA-256 hash-chained log whose integrity is verified on a schedule; tampering is detectable.
Forensic watermarking. Documents are stamped per viewer at access time, so a leak traces back to its source.
Zero training, zero provider retention. Your content is never used to train models and is not retained by our AI providers.

Subprocessors

The third parties that operate the service. We give advance notice of material changes to this list.

Provider	Purpose	Location
Supabase	Database, authentication, storage	Germany (EU)
Vercel	Application hosting / CDN	United States
Hetzner	Document processing (transient)	Finland (EU)
Stripe	Payments (billing data only)	United States
Resend	Transactional email	United States
Twilio	SMS / WhatsApp invitations	United States
Anthropic	AI responses (zero retention, no training)	United States
Voyage AI	Text embeddings (zero retention)	United States
Google	OAuth sign-in	United States

To be notified of subprocessor changes, email security@sifrsys.com.

Availability

Sifrsys runs on managed, highly-available infrastructure. Report any availability issue to security@sifrsys.com.

Request our security documentation

For your vendor review, we can share — under NDA where appropriate — our security whitepaper, subprocessor list, Data Processing Agreement, and completed security questionnaire (CAIQ / SIG). Email security@sifrsys.com and tell us what your team needs.

To report a vulnerability, see our disclosure policy.