Enterprise Security

Enterprise security and data protection

The database is in Zurich, Switzerland; model processing is in Belgium and web functions are in Frankfurt. The CDN is global. Switzerland is not an EU member; transfer conditions require legal assessment.

Data and Compute Locations

Database: Zurich, Switzerland (Supabase eu-central-2)
Model processing: Belgium (europe-west1); web functions: Frankfurt (fra1), global CDN
Daily database snapshots; PITR is not enabled. Storage object backups and restore acceptance are verified separately
Automated data flow records under KVKK Article 9
Erasure requests target 48 hours operationally; confirmation and partial/completed status are tracked separately

Identity Management and RLS Tenant Isolation

Clerk authentication — MFA supported
Org-scoped tenant isolation (PostgreSQL Row Level Security)
All org-access events recorded in an audit log
Cross-org access only via platform admin privilege
Invitation-only onboarding — self-serve signup disabled

Model Auditability — Version-Locked, Fixed Seed

Open-source Bayesian core (Google Meridian)
Reproducibility is verified separately for runs with matching input, seed, version and execution records; it is not assumed for older runs
Posterior artifact archive for every model run
R-hat convergence check (≤ 1.1) reported automatically
Model logic and prior assumptions open to client review

→ Meridian GitHub

Compliance Roadmap

KVKK — Current

Data flow records, PII detection and erasure-right flow are active.

SOC 2 — Planning

Audit process under evaluation.

ISO 27001 — Planning

Under evaluation within the information security management system.

Incident Response

4-hour notification SLO for critical security events
Direct communication with affected customers
Post-mortem publication policy

Run a technical security review

Meet with our technical team on architecture, KVKK flows and model auditability — and assess your enterprise SaaS security requirements together.