Tenant isolation, a tamper-evident audit chain, MFA, encrypted backups, AI that never trains on your data, a SOC 2 roadmap, and named sub-processors. We publish how each one works so you can verify it — not just trust it.
Every table that holds tenant data is scoped by RLS policies enforced inside Postgres — not at the application layer. We use FORCE ROW LEVEL SECURITY so even the table owner cannot accidentally bypass the policy. Per-tenant storage buckets and signed-URL access prevent cross-tenant reads from object storage.
Every signable artefact — log, lab result, certificate, report, signature — is hashed with SHA-256 and chained to the previous record by a database trigger that you cannot opt out of. Tampering with any historical record breaks the chain. The chain is re-verifiable from a CSV export, so you do not have to trust our hosting to trust the audit.
Time-based one-time-password authentication is available to every user. Signing and countersigning a report requires an AAL2 step-up authentication check. Recovery codes are issued on enrolment and stored encrypted at rest. We do not support SMS-based MFA.
AI inference runs on AWS Bedrock in the service region described in our Privacy Policy. The Bedrock foundation models used for reasoning, photo classification, and fast-tier checks are not trained on customer data. We do not use Anthropic, OpenAI, or GPT family models in any user-facing AI path.
You own every borehole, lab result, model, and report you put into TerraBrains. Export supported workspace data and files from the application, including AGS 4.x, DIGGS 2.x, CSV, report PDFs, and audit-chain hashes. We never sell your data, never share it for advertising, and never use proprietary borehole models or reports to train AI. Our retention and deletion practices are described in the Privacy Policy.
All traffic is TLS 1.2+ end to end. Data at rest — Postgres, object storage, and backups — is encrypted with AES-256 by the managed cloud layer. Secrets and signing keys are held in managed secret stores, never in source. Single-use, time-boxed signed URLs gate every file read.
The database is backed up automatically every day with point-in-time recovery, so we can restore to any moment within the retention window. Object storage is redundantly stored across availability zones. The audit chain means a restore is independently verifiable — you can prove the recovered data is the data you signed.
The shared service currently uses the primary hosting and AI-inference regions described in our Privacy Policy. A regional or single-tenant deployment may be scoped for Enterprise customers by arrangement; it is not a self-service residency selector.
Our controls — access management, encryption, change management, logging, and vendor review — are mapped to the SOC 2 Trust Services Criteria. A Type II report is on the roadmap; we are not certified. A draft DPA can be requested for procurement review and becomes binding only when agreed by the parties.
We use a small, deliberate set of sub-processors: AWS (App Runner + CloudFront for web delivery, Bedrock AI, and storage), Supabase (managed Postgres + auth), Dodo Payments (merchant-of-record billing and tax — it handles worldwide payments, currency and tax), and Resend (transactional email). Each is a reputable provider with its own published security posture. We notify customers before adding a new sub-processor that touches tenant data.
Firms with data-localisation or isolated-environment requirements can discuss a single-tenant or on-prem deployment with us. Availability, architecture, support boundaries, and commercial terms are agreed in a separate written scope; these deployments are not included in the self-service product.
Production dependencies are pinned. We scan continuously for known vulnerabilities and review upgrades before merging. The supply chain does not include Anthropic, OpenAI, or GPT family SDKs in any AI-serving path. Authentication, storage, and database layers are managed services with their own security postures published.
We review good-faith security reports sent to this address. Please include enough detail for us to reproduce the issue and avoid accessing or modifying other customers’ data. We do not publish a response-time SLA on this page.
Email security@terrabrains.ai with a description of the issue, the steps to reproduce it, and the impact you observed. We acknowledge inside one business day, give you a fix timeline inside three, and credit you publicly when the fix ships if you ask to be credited.