Substanto
How we protect your data
Where your data is stored
Your documents and answers are stored in the EU (Ireland), on Supabase. Supabase encrypts stored data with AES-256, with encryption keys protected by hardware security modules. Connections are encrypted in transit (TLS), and our app refuses unencrypted database connections. When you upload a policy, we keep its text, not the original file.
Our app server runs in the US (Render, US West), so your data passes through the US while it's being processed. It's stored in the EU.
Who can reach it
Customer data in our database can only be reached through the Substanto app, apart from our own administrator access. The database's public API is closed, and row level security is on for every table. Each account only sees its own data. There is no admin screen that shows customer content.
How we check our code
Every code change is automatically scanned for security issues and leaked passwords or keys, and the code is also scanned weekly.
Safe exports
Exported Excel and CSV files are protected against spreadsheet formula injection, so text in an answer can't run as a formula when you open the file.
Backups
Weekly backups are encrypted (AES-256) and held by GitHub in the US. Each backup is deleted after 28 days.
AI processing
To draft answers, the relevant passages from your documents are sent to Anthropic, and document text to Voyage AI for search. Both process data in the US, and neither trains its models on it.
Who we share data with
Supabase, Render, Vercel, Anthropic, Voyage AI, Resend and GitHub. Full details on our Subprocessors page.
What we don't have yet
- No security certifications (no SOC 2, ISO 27001 or Cyber Essentials).
- No multi-factor sign-in or single sign-on for customer accounts.
- No independent penetration test.
We'll update this page as that changes. Questions: privacy@substanto.com
Privacy Policy · Subprocessors · Data Processing Agreement · Home
Substanto Ltd. Registered in England and Wales, company number 17447004. Registered office: Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.