Security at Understify

At Understify, security is fundamental to everything we do. We implement multiple layers of protection to keep your documents private and accessible only to you and the people you share them with. Each statement below is something we do today unless it is marked as planned.

• Encryption in Transit and at Rest

  TLS in transit; AES-256 at rest, managed by Supabase. Not end-to-end: documents are processed on our servers and by our AI provider (OpenAI).TLS + AES-256

• Your Data Rights

  You can ask us to access, export or delete your data. We do not claim GDPR certification; the status of our data-protection work is listed under Compliance below.UK GDPR

• Hosting

  We run on Hetzner (application) and Supabase (database and file storage). Supabase publishes its own SOC 2 Type II report; that is the provider's assurance, not an Understify certification. Understify itself holds no SOC 2 report and offers no uptime SLA yet.Hetzner + Supabase

• Access Control

  Role-based access control (RBAC) for organisation workspaces: viewers are read-only; owners, admins and editors can approve. Approvals of proposed contract changes are logged.RBAC

• Data Isolation

  Row-level security policies in the database scope each record to its owner or organisation. Documents are shared only when you share them.RLS

• Independent Testing

  No independent penetration test has been completed yet. One is planned before public launch.Planned

• Team Security

  Team plans add shared workspaces with role-based permissions for who can view, edit and approve.Team plans

• Backup & Recovery

  Database backups are run by our database provider (Supabase). We have not yet completed a timed restore drill; we will publish tested recovery times once we have.Provider backups

Service levels

No SLA yet

Row-level security

On every table

Encryption at rest

AES-256 (provider-managed)

• In transit

  Data sent between your device and our servers is encrypted with TLS. Documents are decrypted on our servers to be analysed and are sent to our AI provider (OpenAI) over TLS, so we do not describe this as end-to-end encryption.

• At rest

  Stored documents and database records are encrypted at rest (AES-256) by Supabase; the provider manages the keys. We do not yet add our own application-level encryption on top.

• Infrastructure

  We run on Hetzner (application) and Supabase (database and file storage). Supabase publishes its own SOC 2 Type II report; that is the provider's assurance, not an Understify certification. Today that means:

  • Single-region hosting; multi-region redundancy is not offered
  • Database backups run by our database provider
  • Service levels (no uptime percentage is promised yet)
  • A timed restore drill is planned and has not been completed yet

• Data isolation

  Row-level security is enabled on every application table, and its policies scope each record to its owner or organisation. Documents are shared only when you add teammates to a workspace or create a share link.

• Authentication

  Sign-in is handled by Supabase Auth (email and password, or Google). Supabase stores passwords as bcrypt hashes, never in plain text. Multi-factor sign-in with an authenticator app (TOTP), required for administrators and optional for members, with one-time recovery codes. You turn it on from the Security page in Settings. SMS codes and passkeys are not offered.

• Authorization

  Access to your documents is controlled by row-level security and organisation roles (RBAC). Only you can access your documents unless you share them with a team workspace or a share link.

• Monitoring

  Application errors are reported to our error-monitoring provider (Sentry), and approvals of proposed contract changes are recorded in an audit log. We do not yet run 24/7 security monitoring.