Security
A short, honest read of how we treat your data.
Data ownership
Your workspace data — companies, agents, memories, integrations — is stored in a Supabase Postgres database we own. We do not train any model on your data. A self-serve export API is not built yet; ask us and we will pull your data out manually.
Encryption
TLS 1.2+ in transit. AES-256 at rest (Supabase-managed Postgres). API keys you provide via BYOK are held in Supabase Vault — application tables store only a reference, and the value is decrypted at request time.
Authentication
Supabase Auth. Magic-link, plus Google / GitHub / Microsoft / Apple OAuth. No passwords stored on our side. Sessions are JWT, scoped per-workspace via RLS.
Row-level security
Every table that holds user data has RLS policies enforced by Postgres rather than by application code, and tenant separation rests on those policies. We are mid-way through a security hardening pass and are not claiming the boundary is airtight today — an internal audit is open and we are working through its findings. Treat OrgMapAI as public beta software: do not put data in it that you could not tolerate another beta user seeing. We will update this page as the pass completes.
BYOK posture
Bring your own keys for Anthropic, OpenAI, Google, Voyage, and others. When BYOK is active for a seat, requests proxy through our edge functions to your provider — which means we do handle the full provider response server-side in order to run the agent loop, tool calls, and metering. We do not train on it and we persist only what the agent stores by design, but we are not blind to it.
Subprocessors
Cloudflare (CDN, DNS), Supabase (database, auth, storage, edge functions), Stripe (billing), Resend (transactional email). PostHog (product analytics) and Sentry (error tracking) are wired into the codebase but currently disabled in production. Full list and DPA links available on request.
Reporting a vulnerability
Email security@orgmapai.com (or jpm727@gmail.com directly). We respond within 48 hours. See /.well-known/security.txt for the current policy. We do not publish a PGP key yet — if you need to send something encrypted, say so and we will arrange a channel.
Compliance posture
Public beta. Your workspace is one tenant in a shared Supabase Postgres project, separated by row-level security — not a dedicated database. Supabase, our infrastructure provider, holds SOC 2 Type II; OrgMapAI itself is not SOC 2 audited and their certification does not extend to us. We are not HIPAA-eligible — if you need a BAA, contact us first.
Email security@orgmapai.com — we respond within 48 hours.