Trust & Security

The controls we use to protect your data — and the certifications we're working toward. Last updated May 27, 2026.

Built on SOC 2 aligned principles. We're not yet SOC 2 certified — we're pre-certification. We've adopted controls aligned with the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality) so we're audit-ready when it's time. We won't claim certification we don't have.

How we protect your data

Encryption

• In transit: TLS 1.2 or higher for all client–server and server–provider traffic
• At rest: AES-256 encryption for the application database (managed by our hosting provider)
• Sessions: cookies are HTTP-only, Secure, SameSite=Lax

Access control

• Authentication via Replit's OIDC identity provider — we never see or store passwords
• Domain-restricted sign-in: only authorized email domains can access the application
• Server-side session validation on every API request
• Per-user data isolation: conversations, files, projects, and personal context are scoped to the authenticated user ID at the database level
• Access logs retained for security review

Data minimization & retention

• We collect only what's needed to operate the product — see our Privacy Policy for the full inventory
• Uploaded files are stored in private object storage and deleted by file type: audio within 24 hours, documents and images within 30 days, video is never stored — transcribed and immediately discarded
• Server logs are retained for 90 days
• You can delete any conversation, file, or your full account

Subprocessors

We use the following third-party services to deliver AscendSync Code. Each is bound by their own published security and privacy commitments.

AI training

We have not opted in to any model-training program. Per their published API policies, OpenAI, Anthropic, and Google do not train their models on data submitted via their paid API endpoints. OpenRouter-routed models follow each upstream provider's training policy.

Operational security

Vulnerability management

• Automated dependency vulnerability scanning on every deployment build
• Static Application Security Testing (Semgrep) on every build
• Our deploy pipeline blocks releases that introduce critical vulnerabilities — current critical count: zero
• Dependencies are pinned and patched via npm overrides for transitive CVEs

Backups & resilience

• Database backups are managed by our hosting provider (Replit)
• Application code is stateless and recoverable from source at any time

Incident response

• Designated security contact: [email protected]
• Critical reports acknowledged within 1 business day
• We follow the Coordinated Vulnerability Disclosure model — see our security.txt
• Affected users will be notified of any incident materially impacting their data

Reporting a vulnerability

If you discover a security issue, please email [email protected]. Please do not publicly disclose until we've had a chance to remediate. We aim to acknowledge reports within one business day.

Compliance posture

We maintain a written controls inventory mapped to the SOC 2 Trust Services Criteria. We're happy to share our self-assessment with prospective enterprise customers under NDA.

GDPR alignment

We apply the principles of the EU General Data Protection Regulation (GDPR) — lawful basis, data minimization, purpose limitation, retention limits, and the full set of user rights (access, rectification, erasure, portability, restriction, objection) — for every user regardless of location. We do not claim full legal GDPR compliance and we do not currently offer a signed Data Processing Agreement off the shelf. Enterprise customers needing a DPA should contact [email protected]. See our Privacy Policy for the full user-rights workflow.

Compliance roadmap

• ✅ TLS 1.2+ in transit
• ✅ Encryption at rest for application database
• ✅ Domain-restricted single sign-on (OIDC)
• ✅ Per-user data isolation enforced server-side
• ✅ Automated dependency & SAST scans in CI/CD
• ✅ Coordinated vulnerability disclosure (security.txt)
• ✅ Automatic file deletion (audio 24h, docs/images 30d, video never stored)
• 🔄 Self-service data export (DSAR / GDPR Art. 20) — in progress
• 🔄 Self-service account deletion — in progress
• 🔄 Customer-facing audit log — in progress
• ⏳ SOC 2 Type I assessment — planned
• ⏳ SAML / SSO for enterprise customers — planned
• ⏳ Customer-managed encryption keys (BYOK) — planned
• ⏳ Data Processing Agreement (DPA) template — planned
• ⏳ Per-tenant data isolation for multi-org deployments — planned

Frequently asked questions

Is AscendSync Code SOC 2 certified?

Not yet. We are pre-certification and have adopted controls aligned with the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality) so we are audit-ready. We will not claim a certification we do not hold.

Is AscendSync Code GDPR compliant?

We apply GDPR principles — lawful basis, data minimization, retention limits, and the full set of user rights (access, rectification, erasure, portability, restriction, objection) — for every user regardless of location. We do not claim full legal GDPR compliance; please contact [email protected] for a Data Processing Agreement if you require one.

Do you train AI models on my data?

No. We have not opted in to any model-training program. OpenAI, Anthropic, and Google have publicly stated that data submitted via their paid API endpoints is not used to train their models.

Where is my data stored?

Application data is stored in a Replit-managed PostgreSQL database with encryption at rest (AES-256). Uploaded files are stored in private object storage and automatically deleted according to file type: audio within 24 hours, documents and images within 30 days, and video is never stored — it is transcribed and immediately discarded.

How do I report a security vulnerability?

Email [email protected]. We acknowledge critical reports within one business day and follow the Coordinated Vulnerability Disclosure model. See /.well-known/security.txt for machine-readable contact details.

How do I delete my account or export my data?

Email [email protected]. We respond to deletion and export requests within 30 days. Self-service versions are on our roadmap.