Current controls, service providers, and readiness limits for the assisted launch. Reviewed November 8, 2026. Use this page to identify the evidence and commitments you need before sharing customer data.
| Application hosting | Vercel hosts the application and its server functions. |
| Database and authentication | Supabase provides managed Postgres, authentication, and file storage. The current database region is US East (Ohio). |
| AI processing | Product AI features use the xAI API. Relevant prompts and workspace context are sent to that provider when you use an AI feature. |
| Launch services | Onboarding is assisted. Automated paid checkout and application transactional email are not yet enabled for this launch. Authentication email uses a separate service whose delivery still needs verification. |
| In transit | The application is served over HTTPS, with HTTP Strict Transport Security configured. |
| Provider controls | Database, storage, and AI services have their own encryption and key-management controls. Ask for the provider documentation relevant to your review. |
| Service credentials | Server-side provider credentials are configured through deployment environment settings. They must not be included in customer exports or support messages. |
| Workspace isolation | Application authorization and database policies scope access to a workspace. Release checks include targeted tests for access across workspace boundaries. |
| Roles | Workspace roles limit the actions members can perform. Some administrative actions require owner or manager access; assisted plan changes require a separately authorized operator. |
| Audit coverage | Assisted plan changes record the operator and before/after state. Audit coverage and retention for other actions must be confirmed for your requirements. |
| SSO and MFA | Availability and enforcement depend on configuration. A plan name alone is not confirmation that SSO or multi-factor authentication is enabled for your workspace. |
| Data residency | The database is hosted in the United States. That does not establish a location guarantee for all providers or AI processing. Confirm any residency requirement before uploading data. |
| Data export | The admin Exports panel provides workspace-scoped pipeline, activity, and signals CSVs, with a maximum of 10,000 rows per export. These exports are not a complete workspace archive. |
| Deletion and retention | Contact support for an export or deletion request and its scope. Removing a prospect preserves history; it is not full erasure. Automatic workspace deletion after cancellation is not currently implemented. |
| Provider terms | The draft Privacy Policy and DPA describe current providers. Final retention periods, transfer terms, and contractual commitments still require confirmation. |
| AI data handling | xAI publishes its API data-handling policy, including training permissions and default audit retention. We have not verified a zero-data-retention arrangement for this service. |
| Release checks | Changes go through an accountable release owner, automated checks, and validation appropriate to the affected behavior. Passing these checks is not a security certification. |
| Independent testing | A completed independent penetration-test report is not currently available. |
| Disclosure | Report suspected vulnerabilities to keating.andrewj@gmail.com. Please include the affected feature, reproduction steps, and potential impact without sending sensitive customer records. |
| Monitoring | Basic application health checks are available. Dedicated external error monitoring is still being prepared. |
| Incident contact | Report a suspected incident to keating.andrewj@gmail.com. Contractual notification and support response commitments must be agreed before purchase. |
| Backups | Scheduled database backup snapshots are present. Point-in-time recovery is not enabled in the verified configuration. Database backups do not include uploaded files in Supabase Storage. |
| Recovery readiness | Uploaded-file backups and a completed restore drill are not yet verified. No fixed recovery time or maximum data-loss interval is promised. |
| SOC 2 | ProspectSentinel does not currently have a SOC 2 report. |
| Privacy and contractual review | The public Terms, Privacy Policy, and DPA remain drafts. Seller details and operating commitments must be finalized before they can be treated as an agreed customer contract. |
| Sensitive data | Do not submit payment-card details, protected health information, or other regulated sensitive records through product fields or support email. |
We welcome responsible disclosure. If you've found a security issue:
Contact us to review the evidence available for your requirements:
Email keating.andrewj@gmail.com with your request.