How we earn the right to handle your repo, your voice, and your audience.
Security and compliance posture, kept current. Every control listed here is implemented and has an artifact in the repo; anything still in progress is explicitly marked Planned. When our SOC 2 Type II audit begins, these controls map onto its control set.
Last reviewed
Security overview
Defense in depth across edge, app, data, and operational layers.
Encryption in transit
TLS 1.3 everywhere. HSTS at the edge (Cloudflare). Workflow traffic to Temporal Cloud is mutually authenticated with client-certificate mTLS (publisher, render, scheduler and capture each hold their own cert).
Encryption at rest
Neon-managed encryption at rest for Postgres; Cloudflare R2 server-side encryption for object storage. Sensitive secrets (e.g. platform OAuth tokens) use per-workspace data keys via envelope encryption (dm-vault). Residual AWS backups are encrypted under an AWS KMS key tree.
Tenant isolation
Postgres row-level security on every workspace-scoped table. A CI isolation test seeds two workspaces and runs cross-workspace read attempts; the build fails on any leak.
MFA
TOTP (Clerk) required for owner-role users. Optional for others. SMS deliberately excluded — SOC 2 prefers TOTP / WebAuthn over SS7.
Secrets + dependency scanning
gitleaks pre-commit + on push, Semgrep + CodeQL SAST, weekly cron sweeps. Push protection blocks committed secrets.
Audit logs
Every state change writes a row to audit_log with workspace/user/action/entity context. Retention: 1 year online, archival for the SOC 2 audit window.
Edge protection
Cloudflare WAF + rate limits in front of the gateway. Security response headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are served on every marketing route from a single declared policy — see apps/marketing/security-headers.mjs.
Backup + recovery
Neon continuous backup with point-in-time recovery to any moment in the last 30 days, plus residual AWS Backup. A restore drill runs on a schedule (.github/workflows/t8-restore-drill.yml, first of each month) and can be triggered on demand against any point in time.
Content provenance & AI transparency
Everything this engine publishes is machine-made, and we would rather say so in a way a machine can check than bury it in a footer. The EU AI Act's Article 50 transparency obligations for synthetic content applied from 2 August 2026; the mechanisms below are how we meet them, described precisely enough that you can audit the claim rather than trust it.
A signed C2PA claim on every published asset
The renderer writes an unsigned C2PA sidecar next to every video and image it produces. At publish time we sign that claim with an ES256 key belonging to your workspace alone, pulled from our secrets vault — so the signature identifies which workspace produced the asset, not just that SuperPost did.
What the signature actually covers
The claim payload is canonicalized (JCS, RFC 8785) and signed as ES256 over those exact bytes. It carries the standard C2PA assertions, including c2pa.actions (what was done to the asset) and c2pa.training-mining (whether the asset may be used for model training). Same cryptography and same manifest schema as an embedded manifest.
Detached today, embedded next
We publish the signed manifest as a detached JSON document alongside the asset rather than wrapped inside the file itself. That means a generic Content Credentials viewer opening the video will not find it — you verify by fetching the manifest and checking the signature against the public certificate chain. Embedding into the file is a packaging change on our side, not a change to what is signed.
Externally checkable, not just claimed
Public posts expose the manifest URL and the SHA-256 of the sidecar. Fetch one, hash it, and it must reproduce the published digest — so the provenance record can be checked by someone who does not trust us, which is the only kind of provenance worth having.
Platform-native AI labels where they exist
TikTok's AIGC tag and YouTube's synthetic-media disclosure are set by us through their publish APIs. Meta's AI-info label has no API parameter, so Meta applies it platform-side.
A disclosure line where they do not
X and LinkedIn have no native AI flag at all. Rather than let that be a silent gap, we append our own disclosure to the post copy. An autonomous publish — where the engine chose the words and the moment with no human at send time — can never resolve to no disclosure on any platform.
One thing we deliberately do not claim: that the manifest is readable by a general-purpose Content Credentials viewer today. It is detached, not embedded in the file. That is a packaging limitation we are removing, and until we do, saying otherwise would be the exact kind of provenance theatre this section exists to avoid.
Compliance status
Current state, not roadmap. We update this when posture changes, not on a marketing schedule.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | Planned | Audit not yet commenced; the observation window is targeted to open Month 6. Controls are mapped to CC1-CC9, A1, and C1, and continuous-evidence collection wires up once the first enterprise customer signs. No report exists yet. |
| GDPR | Compliant | Article 15 export + Article 17 erasure live (POST /v1/account/export, POST /v1/account/delete). DPA template + auto-fill. EU sub-processor transfers under SCCs 2021/914. |
| CCPA / CPRA | Compliant | Same data access + deletion endpoints satisfy California requests. No sale of personal information. |
| ISO 27001 | Planned | Not in v1 scope. Targeting Year 2 once SOC 2 is established. |
| HIPAA | Out of scope | SuperPost is not designed to process Protected Health Information. Do not upload PHI. |
External validation
Penetration tests
Annual third-party pen test. First engagement scheduled post-launch. Public summaries (with remediation status) land here after each engagement.
No engagements completed yet.
Vulnerability disclosure
Open invitation to security researchers. 24h ack, 7d triage, per-severity remediation SLAs. Policy →
A paid bug bounty program will launch when volume justifies it.
Uptime + incidents
Real-time service status + incident history at status.superpost.io.
Privacy + legal
Security review questions?
Email security@superpost.io and we'll get back within one business day. We have a security review questionnaire on file with answers to the standard SIG / VSAQ / CAIQ-Lite asks.