Security
This document is a working draft published for vendor review and is subject to legal review. The signed customer agreement controls where the two differ.
1. Overview
SOP Intel is deployed as a dedicated, single-tenant instance for each customer: its own database, its own storage bucket, its own application services. No other customer’s data shares the stack. Data access from the application is server-side only, every request passes an authentication gate, and recordings are reachable only through short-lived signed URLs.
This page describes the controls as they exist today, including gaps. It is written for the IT and security reviewers of our customers. Questions and vulnerability reports go to contact@sopintel.com.
2. Architecture and hosting
- Web application (Next.js, TypeScript) and a background worker(Node) run as containers on Railway in the United States. Only the application’s HTTPS endpoint and a health check are exposed.
- Database and authentication run on Supabase (managed Postgres and GoTrue). Row-level security is enabled on every table with no permissive policies, so the key present in the browser can read nothing; all data access goes through the server with a service credential that never leaves it.
- Object storage for recordings, extracted audio, frames and attachments is a private Cloudflare R2 bucket per environment.
- Secrets live only as encrypted environment variables on the hosting platform. None are committed to source control.
3. Encryption
- All traffic is TLS: browser to application, application to database, storage and providers.
- Database and object storage are encrypted at rest by the providers.
- Stored recordings and frames are never public. They are served only through URLs the server mints for an authenticated, authorized user, valid for one hour.
4. Access control and identity
- Invitation only. Self-signup is disabled. A customer administrator creates each account and issues a one-time initial password; users can change it themselves and administrators can reset it.
- Roles. Member, executive and administrator. Executive insights are visible to leadership roles only; administration (users, departments, process ownership, deletion) to administrators only.
- Visibility. Processes are visible by department assignment, by explicit share, or to leadership. Authorization is enforced in application code on every request.
- Disable and offboard. Administrators can disable an account instantly; the ban is enforced on every request, and the account can be re-enabled without data loss.
- Not yet in place. Multi-factor authentication and single sign-on are not enabled today. SAML or Entra ID single sign-on is planned and is supported by our authentication provider; customers who require it should raise it during onboarding.
5. Data handling in the processing pipeline
- A user uploads a recording directly to the private bucket via a signed URL.
- The worker extracts the audio track and still frames. Audio is sent to the speech-to-text provider through a short-lived URL, with the model-improvement opt-out flag on every request.
- The transcript text and process metadata onlyare sent to the language-model provider to produce the structured record. Video and screenshots never leave our environment. The provider’s API does not train on this data.
- Generated documentation refers to people by role, not by name, by instruction. Steps a reviewer flags as sensitive have their extracted screenshots deleted before the record is saved.
- Every provider call is logged with provider, model and cost for metering and audit.
6. Retention and deletion
- Raw recordings are retained while the process exists so documentation can be regenerated. A scheduled purge of raw footage after publication can be agreed per customer.
- Process deletion is a hard delete by an administrator or the creator: storage objects first, then the database record. An audit script verifies that no orphaned objects remain. Billing records survive but no longer reference the content.
- Provider-side: the speech-to-text provider retains no audio under the opt-out we send; the language-model provider retains API logs for a limited period (about 30 days) unless zero-data-retention terms are arranged for the customer.
- All customer content is deleted or returned at the end of the agreement, or earlier on written request.
7. Logging and monitoring
- Usage events record every transcription and language-model call.
- Process views and last-viewed timestamps are tracked per user.
- Authentication events are logged by the identity provider; request logs are held by the hosting platform.
- A consolidated audit log of administrator actions (user creation, role changes, sharing, deletion) is on the roadmap and not yet in place.
8. Subprocessors and their attestations
The providers below each publish independent audit reports (SOC 2 Type II; some also ISO 27001). Where a customer’s vendor-management process requires copies, we will help obtain them through each provider’s trust portal.
| Provider | Purpose | What it receives | Notes |
|---|---|---|---|
| Railway | Application hosting (web app and background worker) | All application traffic and processing in transit; environment configuration | US region. Secrets held only as encrypted environment variables. |
| Supabase | Managed Postgres database and authentication | Account records, process documentation, roles, sharing grants, usage events | Encrypted at rest. Row-level security enabled; data access is server-side only. |
| Cloudflare R2 | Object storage for recordings and extracted frames | Uploaded recordings, extracted audio and frames, attachments | Private bucket per environment. Access only via server-minted URLs valid for one hour. |
| Deepgram | Speech-to-text transcription | Audio extracted from a recording, fetched via a short-lived URL | Every request is sent with the model-improvement opt-out flag. No training on customer audio. |
| Anthropic | Language model for document extraction and automation assessment | Transcript text and process metadata only. Never video, never screenshots. | API usage is not used for model training. Anthropic retains API logs for a limited period (about 30 days) unless zero-data-retention terms are in place. |
| GitHub | Source control and deployment trigger | Application source code only. No customer data. | Private repository. |
9. Development practices
- Source is held in a private GitHub repository. Changes land through pull requests and deploy from the main branch.
- All inputs and model outputs are validated against typed schemas; model responses use structured outputs.
- Dependencies are audited and patched as part of release work.
- Environments are isolated from one another, each with its own database, bucket and secrets.
10. Compliance posture, stated plainly
SOP Intel is a new company. As of the effective date of this page:
- We do not hold our own SOC 2 or ISO 27001 attestation. Our controls inherit from the audited providers listed above, and we will provide their reports.
- No independent penetration test of the application has been performed yet. One can be scoped as part of a customer engagement.
- Multi-factor authentication and single sign-on are not yet enabled (see Access control).
- We carry general liability and technology errors and omissions insurance.
We would rather state these gaps than imply otherwise. The Privacy Policy and a data processing agreement, available on request, set out our commitments in writing.
11. Reporting a vulnerability
If you believe you have found a security issue, email contact@sopintel.com with enough detail to reproduce it. We will acknowledge within two business days, keep you informed as we investigate, and not pursue action against good-faith research that respects customer data and avoids service disruption.