Security & AI Governance Overview

1. Product overview

Alpha Scaling delivers AI-assisted business audits for established service businesses. An engagement combines a structured intake and uploaded business documents with a versioned analysis engine and a maintained knowledge base; AI assists the analysis; and the audit team reviews and publishes the findings a client sees.

The client platform is available only to authenticated accounts — nothing in it is served to anonymous visitors. A fuller walk-through is on How it works, and the trust program is summarized on the Trust Center.

2. Data categories

What the platform holds, and how each category is handled:

• Account & profile — login, role, and organization. AI-assisted features see the organization name only.
• Organization & engagement metadata — company details, status, dates, and day targets used to run and track the audit.
• Audit intake & checklist responses — the questionnaire inputs; only labels and status are exposed to the assistant.
• Uploaded business & financial documents — handled as sensitive; kept in private storage; document contents are not sent to the AI assistant and are processed server-side by the analysis engine.
• Automated document-check verdicts — deterministic validation results; only a verdict label is exposed to the assistant.
• Audit findings — leak zones, dollar ranges, and confidence, produced by the engine and gated behind human review and publication.
• Deliverables, messages & activity events — reports (private until published), communication, and an append-only activity log.

Marketing lead data submitted through our funnel (name, email, phone, company, revenue bracket, and fleet size) is handled separately from the audit platform for advertising measurement. See Privacy and Cookies.

3. Architecture overview

This is a conceptual description of how the system is organized. It intentionally omits hostnames, addresses, and other operational detail.

• A prerendered marketing site and a separate, authenticated client platform.
• A managed database provides authentication, storage, and access control; privileged operations run inside server-side functions, never in the browser.
• A separate, versioned analysis engine and a maintained knowledge base perform structured analysis server-side.
• AI model access happens only on the server; the browser never holds model credentials.
• The browser is treated as untrusted input; authorization is always enforced on the server.

Conceptual data flow

Conceptual overview of how information flows, not a description of our infrastructure.

4. Identity & access

Least privilege is a core design principle. Every request is authorized on the server against the caller's verified identity, not against values supplied by the browser.

• Accounts and sessions are managed by Supabase Auth, with password and magic-link sign-in.
• Server-side functions verify the caller's session token (JWT) before performing any work; unauthenticated requests are rejected.
• Client and staff/auditor roles are separated; staff-only operations run through dedicated, role-checked procedures.
• Staff-only actions are enforced inside SECURITY DEFINER database functions that verify the staff role and log every change to an append-only event log; the organization is always derived from the engagement, never from caller input.

5. Organization isolation

Tenants (organizations) are isolated in the database itself, not only in application code.

• Row-Level Security is enabled and forced on every table, with a default-deny posture — a request sees nothing unless a policy explicitly grants it.
• Access policies are scoped to the caller's own user and organization (auth.uid()).
• Sensitive tables, such as audit findings, have no direct write access for ordinary accounts; those writes happen only through controlled server-side procedures.
• Certain internal tables are configured as deny-all (Row-Level Security enabled with no client-facing policy) and are reachable only by trusted server-side roles.

6. File security

• Uploaded business documents are held in private storage buckets that are not publicly accessible; files are served only through short-lived signed URLs.
• Every uploaded file passes a deterministic, server-side validation step that runs no AI model, enforces a parse-size limit, and records its verdict before the file is accepted.
• Document contents are never sent to the AI assistant; they are processed server-side by the analysis engine.
• Documents can be soft-deleted, and an organization's data can be purged, through dedicated server-side operations.
• Document contents are never exposed to another organization.

7. Auditability

Because the product itself is an audit, traceability is built in.

• Significant actions are written to an append-only event log; the events a client can see are explicitly whitelisted.
• Every staff change to findings writes an append-only event that records the actor.
• Each AI assistant exchange records a single audit row capturing only metadata, such as input size and success — not the conversation content.
• Findings move through a review-and-publish workflow and become visible to a client only once published.

How analysis is reviewed before it reaches a client is described on Audit Integrity.

8. AI architecture

AI is an analytical tool that operates inside defined workflows — not the decision-maker. Our AI-assisted features use Anthropic's Claude (Haiku 4.5). We take a risk-based approach to AI governance.

• A versioned analysis engine produces findings from your data and a maintained knowledge base; a scoring step evaluates each potential lever.
• The in-panel assistant is a status-and-process helper, deliberately kept away from producing client-facing numbers.
• Model access happens only on the server; the browser never holds model credentials, and the assistant is gated by the caller's verified session.
• The assistant's context is built on the server from the caller's own profile and engagement — never from identifiers supplied in the request — keeping it scoped to the caller's organization.
• Requests are bounded: a cap on recent messages (20), a per-message input limit (2,000 characters), a bounded model response (600 tokens), and a 30-second timeout.

Full detail is on AI Governance.

9. Human review & publish gate

• Publish gate — a finding that has not been published is invisible to the client by design; access rules return only published findings, and only for the client's own organization.
• Assistant barred from numbers — the in-panel assistant is explicitly prevented from producing findings, dollar amounts, or benchmarks.
• Findings only from published rows — any number a client sees comes from a published finding reviewed by the audit team, never from the assistant.

In short: AI-assisted analysis, reviewed and published by the audit team. More on Audit Integrity.

10. AI data handling

• Data minimization — data sent to the model is limited to metadata such as file names, statuses, and labels; document contents and financial figures are not sent to the assistant.
• Not persisted — prompts and outputs are not retained beyond a single minimal audit event (input size and success only).
• Tenant-scoped context — the assistant's context is derived server-side from the caller's own organization, never from request parameters.
• Vendor governance — the AI provider is a critical subprocessor governed by our vendor due diligence.

11. Subprocessors

Core application data (database, storage, and authentication) is hosted with Supabase in the United States (AWS us-east-1). Other processing locations are provider-dependent.

The full, current list is on Subprocessors.

12. Privacy approach

Privacy is built into how the platform works, not bolted on. We are GDPR-conscious and design to support applicable privacy obligations; this is a privacy-by-design orientation, not a certification.

• Data minimization — AI-assisted features receive only metadata, not document contents or financials.
• Purpose limitation — information is used to deliver and support the audit engagement; funnel data is used for advertising measurement and kept separate.
• Controlled access — scoped by organization and role through forced Row-Level Security, with private, signed-URL-only file storage.
• Data lifecycle — Retention periods vary by data category and business requirement. Alpha Scaling is formalizing category-specific retention schedules.
• Deletion — document soft-delete and full organization purge are available.
• Your rights — where a region grants data-protection rights (for example the EU/UK or California), they can be exercised by contacting us.

Full detail is in our Privacy Policy and Data Governance page.

13. Security framework approach

Our controls are informed by relevant SOC 2 Trust Services Criteria — principally Security, Availability, and Confidentiality. This is a design orientation: it does not mean every criterion is satisfied, and no attestation is claimed.

No third-party penetration test or independent audit has been performed to date; internal security reviews are conducted. See Security for the controls behind this approach.

14. Known certification status

We are honest about our current status. We do not hold, and do not claim, any third-party security or privacy certification.

We hold no HIPAA or PCI certification, and the platform processes no payment-card data.

15. Security contact

Related: Trust Center · Security · Control Summary · How it works · AI Governance · Audit Integrity · Subprocessors.