Trust
What we do today to protect your data, and what we do not claim yet.
SOC 2: not yet. We do not currently have a SOC 2 report. We're documenting and implementing controls toward SOC 2 readiness, and can answer security questions about the controls in place today.
Security at a glance
Infrastructure
- Hosting
- Cloud Run and Cloud SQL (Postgres), us-central1
- Encryption
- TLS in transit, Google-managed encryption at rest
Backups and recovery
- Backups
- Daily, 7 kept
- Point-in-time recovery
- 7 days
Sign-in and access
- Two-factor
- Authenticator app, passkeys, SMS or email codes; organizations can require it
- SAML
- Business plan
- Sessions
- End after 14 days idle or 30 days total
- API keys
- Hashed at rest and shown once
Audit
- Audit log
- On every plan; staff actions appear as Asizor support
Security questions
What do you store about the addresses I send?
Each API call's request and response, including the address, is kept as a usage record on your account while the account exists. Addresses geocoded by Geocodio are also cached permanently, so a repeat lookup doesn't call the geocoder again. That cache is shared by all customers and isn't tied to your account.
How long do you keep data, and what happens when I delete it?
Database backups expire after 7 days. When an organization is deleted, the contents of its usage records are removed after 30 days. Audit log entries are kept as a security record, with a deleted user's personal details anonymized. Geocode cache entries stay, because they aren't tied to an account. Details: Privacy Policy, section 5.
Where are addresses processed?
Geocodio geocodes them on its Self-Serve platform, which is hosted in Europe. If Geocodio can't answer an address search, we fall back to the U.S. Census Geocoder in the United States; those results are not cached. Everything else runs on Google Cloud in us-central1.
What happens if there's a security incident?
We notify affected customers of a personal data breach without undue delay, with the information we have to help you meet your own obligations.
How is internal access controlled?
Staff access to customer accounts is limited to authorized staff and always requires two-factor sign-in. Staff actions on a customer account are recorded in the audit log and appear as Asizor support.
How are the network and environments separated?
The database has a private IP only and accepts encrypted connections only. Staging runs in its own Google Cloud project, separate from production.
How do you develop securely?
Pull requests run static checks, the full test suite and an automated code review, and CI checks our Elixir dependencies against known security advisories.
Do you encrypt sensitive fields in the application?
Yes. Two-factor secrets, SMS phone numbers and sign-in provider tokens are encrypted with AES-256-GCM, on top of database encryption at rest. API keys are stored only as a keyed hash.
Do you sell my data?
No. See our Privacy Policy.
Do you sign a DPA or answer security questionnaires?
We answer reasonable written security questionnaires. Every plan will include a standard Data Processing Addendum, published at launch.
Subprocessors
| Company | What for | Processing / hosting |
|---|---|---|
| Google Cloud | Application hosting and database | United States (us-central1) |
| Cloudflare | Website hosting, DNS and edge protection | Global edge network |
| Geocodio | Address geocoding | Europe (Self-Serve platform) |
| U.S. Census Bureau Geocoder | Backup address geocoding, only when Geocodio can't answer | United States |
| Postmark | Transactional and waitlist email | United States |
| Twilio | SMS sign-in codes, only if you choose SMS | United States (US1 region) |
| Stripe | Payments and billing | United States, plus Stripe affiliates and subprocessors elsewhere |
| Google Workspace | Company email and documents | Global (no data region selected) |
Customers covered by the DPA are notified of applicable subprocessor changes before they take effect.
Vulnerability reports
Email security@asizor.com. We aim to acknowledge vulnerability reports within 3 business days. Read the disclosure policy or our security.txt.