Security

Last updated: August 14, 2026

Agency OS is not yet ISO 27001 or SOC 2 certified — we are a small team and have not gone through formal third-party audit. This page describes the concrete technical and organisational measures we have in place today, so you can evaluate our security posture honestly rather than take a badge on faith.

Infrastructure

  • Hosting: Vercel (application), Supabase Pro (database, auth, storage) — EU data residency
  • Analytics: PostHog, EU servers only
  • Error monitoring: Sentry, EU servers only
  • Rate limiting: Upstash Redis, Frankfurt region, on all authentication and API endpoints

Data Protection

  • Row Level Security (RLS) enforced on every database table — access control lives at the database layer, not just in application code
  • No direct database access from client applications; all access is mediated by Supabase Auth and RLS policies
  • Data encrypted in transit (TLS) and at rest (Supabase-managed encryption)
  • Account deletion permanently removes personal data immediately, aside from billing records we are legally required to retain (§ 147 AO, up to 10 years)

Payments

  • Card and payment data is handled entirely by Stripe — we never see or store card numbers
  • Stripe is PCI DSS Level 1 certified, the highest level of payment card industry compliance
  • Apple In-App Purchase (iOS) is processed entirely by Apple via StoreKit; we only verify signed transaction receipts server-side

Access Control

  • Authentication via Supabase Auth on a dedicated custom domain
  • No shared credentials or service-role keys are ever exposed to client-side code
  • Production infrastructure access is limited to the founder

Vulnerability Disclosure

If you believe you have found a security issue in Agency OS, please report it to support@agencyos.studio. We take all reports seriously and will respond promptly.

Roadmap

As Agency OS grows, we plan to pursue formal certification (SOC 2) once it is warranted by customer demand and company size. Until then, we aim to be transparent about exactly what protections are — and are not — in place.