Security & Compliance
1. Executive Summary
Section titled “1. Executive Summary”Sociable AI implements a security framework by leveraging industry-standard security practices and compliant third-party providers. Our security approach prioritizes minimal data storage, secure token management, and responsible data handling across all our services. We adhere to platform policies through regular external audits.
2. Service Provider Compliance
Section titled “2. Service Provider Compliance”| Provider | Used For | Provider’s Compliance/Certifications | Security Features We Leverage |
|---|---|---|---|
| Google Cloud Platform | Infrastructure, BigQuery, Pub/Sub | SOC 1/2/3, ISO 27001, GDPR | Infrastructure security, DDoS protection, encryption |
| AWS | Infrastructure components | SOC 1/2/3, ISO 27001, GDPR | Network security, infrastructure protection |
| Vercel | Frontend hosting | SOC 2, GDPR compliance | Edge security, CDN protection, HTTPS enforcement |
| Clerk | User authentication | SOC 2 Type 2, GDPR, CCPA | Identity management, MFA, JWT security |
| Supabase | Database | SOC 2 Type 1, GDPR compliance | Row-level security, data encryption |
| Stripe | Payment processing | PCI DSS Level 1 | Secure payment processing, tokenization |
| Anthropic | AI/LLM services (reply drafting) | SOC 2 Type 2 | API security, no training on API content, US processing |
| Sentry | Application error monitoring | SOC 2 Type 2 | Error and diagnostic data, US data residency |
| Upstash | Rate limiting and API quota caching | SOC 2 | No message content, US region |
| Meta/Instagram | API integration | SOC 2, GDPR | OAuth security, rate limiting, quarterly platform audits |
3. Data Flow Architecture
Section titled “3. Data Flow Architecture”Data Access Flow
Section titled “Data Access Flow”- Authentication: Clerk handles user authentication without us storing credentials
- Social Media Integration: We store OAuth access tokens and the social-media content needed to provide enabled features
- Messaging: Messages processed through GCP’s secure Pub/Sub channels, inheriting Google Cloud’s enterprise-grade security practices and encryption standards
- TikTok direct messages: May be stored to provide reply drafting, conversation history, and automation. Content is deleted when the relevant subscription or contract ends, when a shorter contractual retention period applies, following a valid deletion request, or when the relevant account or workspace is deleted.
4. Data Access Matrix
Section titled “4. Data Access Matrix”| Data Category | What We Store | Access Control | Retention Period | Security Measures |
|---|---|---|---|---|
| User authentication data | Managed by Clerk | Clerk’s security system | Managed by Clerk | Encrypted at rest by Clerk |
| Social media tokens | OAuth access tokens only | System only, no direct human access | Until subscription ends, revoked, or deleted earlier | Encrypted at rest |
| Messages (Instagram, Facebook, WhatsApp, LinkedIn, Telegram, Discord) | Conversation history for automation | User, automation systems | Until subscription ends or deleted earlier | Encrypted at rest |
| Messages (TikTok direct messages) | Conversation history for reply drafting and automation | User, automation systems | Until subscription or contract ends, a shorter contractual retention period applies, or deleted earlier | Encrypted at rest |
| Automation settings | User-defined rules, preferences | User, relevant systems | Until subscription ends or deleted earlier | Encrypted at rest |
| Payment information | Transaction IDs only | Billing system | 7 years (regulatory) | Handled by Stripe (PCI-compliant) |
5. Encryption and Protection Measures
Section titled “5. Encryption and Protection Measures”Data Encryption
Section titled “Data Encryption”- In Transit: All communications secured via TLS 1.3
- At Rest: All user data encrypted in Supabase and other storage systems
- Authentication Tokens: Encrypted before storage
- API Keys: Secured using environment variables and secret management
User Authentication Security (Clerk)
Section titled “User Authentication Security (Clerk)”- Passwordless authentication options
- Multi-factor authentication
- JWT-based session management
- User authentication events monitoring
- OAuth social login security
Access Controls
Section titled “Access Controls”- Role-based access control for internal systems
- Least privilege principle implemented
- Multi-factor authentication required for admin access
6. Incident Response Plan
Section titled “6. Incident Response Plan”Detection
Section titled “Detection”- Real-time monitoring via GCP Monitoring
- Error tracking via Sentry
- Automated alerts for suspicious activities through Google Cloud Security Command Center, AWS CloudWatch, Vercel Analytics, Sentry, Supabase Security Monitoring, and PostHog
Response Procedures
Section titled “Response Procedures”- Containment: Isolate affected systems
- Assessment: Determine scope and impact
- Remediation: Apply fixes and security patches
- Recovery: Restore systems to normal operation
- Post-incident: Review and improvement
Communication Protocol
Section titled “Communication Protocol”- Internal notification within 1 hour of detection
- Client notification within 24 hours for data breaches
- Regulatory reporting as required by law
7. Security Controls and Measures
Section titled “7. Security Controls and Measures”Data Minimization
Section titled “Data Minimization”- Authentication handled by Clerk, limiting our exposure to sensitive credentials
- Storing only the access tokens and social-media content needed for enabled features
- No storage of social media post data beyond what’s needed for functionality
- Clear data boundaries between systems
Authentication Security
Section titled “Authentication Security”- Clerk-managed authentication system
- OAuth 2.0 for social media integrations
- Secure token management
- Session timeout enforcement
Monitoring and Logging
Section titled “Monitoring and Logging”- Centralized logging systems
- Activity auditing
- Regular security reviews
8. Compliance Considerations
Section titled “8. Compliance Considerations”Platform Compliance
Section titled “Platform Compliance”- Meta/Instagram: We regularly undergo platform audits for our integration to ensure adherence to platform policies
Privacy Considerations
Section titled “Privacy Considerations”- GDPR Principles: We apply data minimization principles and provide mechanisms for data access and deletion
- CCPA Principles: We honor user data control and deletion rights where applicable
- Best Practices: We leverage certified third-party providers and follow security best practices
9. Third-Party Data Handling
Section titled “9. Third-Party Data Handling”- TikTok direct message content is retained only for functional requirements
- TikTok direct message content is deleted when the relevant subscription or contract ends, when a shorter contractual retention period applies, when the relevant account or workspace is deleted, or following a valid deletion request
- Data is returned before deletion when required by a written contract
- Message data for other platforms follows the same functional-retention and deletion approach
- Clear boundaries between automation processing and data storage
- Adherence to Meta’s platform terms and data usage requirements
This document represents our current security posture and is subject to regular review and updates as our systems and security practices evolve.