Security
How Signaic protects your data
Signaic is built on a small number of well-known providers, each doing one job. This page says what they do, what they can see, and how the platform itself is protected. Questions go to support.
Practices
- Encryption
- Every connection uses TLS. Data at rest is encrypted by the database and storage providers. Secrets live in a secrets manager, never in code.
- Access control
- Row-level security in the database enforces workspace isolation and plan entitlements independently of the app. Admin actions require multi-factor authentication and are written to an audit log you can review.
- Backups
- The database is backed up daily by the provider and exported nightly to private storage with 30-day retention. A restore is tested every week.
- Monitoring
- Every ingestion source and pipeline reports a heartbeat. A source that stops reporting pages the on-call engineer and shows on the public status page. Errors go to an error tracker within seconds.
- Provenance
- Every record carries its source, the source's own reference, the time we retrieved it and a confidence tier. Every version of a record is kept, so you can ask what the platform held on any date.
- Rate limits and headers
- Every API route is rate limited per client. The site ships a content security policy, strict transport security and the usual protective headers.
Subprocessors
The third parties that run the platform or process data on our behalf.
| Service | What it does | Region |
|---|---|---|
| Vercel | Hosts the web app, the API and scheduled jobs | US |
| Supabase | Database, authentication, file storage and backups | US |
| Anthropic | Claude models for answers, reports, briefs and extraction (no training on API data) | US |
| OpenAI | Text embeddings for search (no training on API data) | US |
| Firecrawl | Fetches public regulator and operator web pages | US |
| Resend | Sends and receives email | US |
| Trigger.dev | Runs background ingestion tasks | US |
| Sentry | Error and performance monitoring | US |
| BetterStack | Uptime monitoring, paging and the status page | EU and US |
| Doppler | Secrets management | US |
| Stripe | Billing and payments (card details never touch Signaic) | US |
Status and disclosure
Live status of the site, the API and every data source group is at signaic.betteruptime.com. To report a vulnerability, email support with the details; we acknowledge within two business days and never take action against good-faith research.