Your data.
Your control.
Last updated: April 8, 2026
After Action is a cyber crisis readiness platform used by security teams, facilitators, and insurance carriers. We take privacy seriously because our customers trust us with sensitive tabletop exercise data, readiness scores, and participant decisions during crisis simulations. This policy explains what we collect, how we use it, and how we protect it.
What we collect
We collect three categories of data:
- Account data — name, work email, organization, role (from signup and Supabase Auth).
- Exercise data — scenario selections, inject decisions, participant responses, gaps, action items, and readiness scores. This is the core data generated by using the platform.
- Usage data — request logs, error traces (Sentry), and product analytics (PostHog), both linked to your user ID and email. PostHog records session replays with every form input masked. No cross-site tracking, no advertising cookies.
We do not collect biometric data, facial recognition data, typing cadence, audio recordings, or any telemetry the participant did not explicitly submit.
How we use it
- Deliver the platform functions you pay for (exercises, scoring, deliverables, certificates).
- Compute benchmarks — all benchmarking uses aggregated, anonymized data across orgs.
- Send transactional email (invitations, AAR-ready notifications, onboarding sequence).
- Generate carrier-facing readiness certificates when clients explicitly request them.
- Improve the product — internal analysis only, never sold.
We do not sell your data. We do not share identifiable client data with carriers, investors, or third parties without explicit written consent.
Carrier data sharing
When a client explicitly requests an insurance certificate, After Action generates a signed artifact containing the readiness score, scope, and exercise metadata. This is shared only with the carrier the client directs us to share it with, and only under the terms the client accepts at the time of issuance.
Carriers who subscribe to the field intake dataset receive aggregated and de-identified data only. Individual client names, participants, and decision text are never included in carrier exports unless the client has separately signed a data sharing addendum.
Where it lives
- Database: Supabase (Postgres) hosted in the United States (Supabase, US region) and never moved across regions. Row-level security is enforced on every table.
- Files you upload (documents, situation decks, briefings): Supabase Storage, private bucket, signed URLs only. AARs, report PDFs and evidence exports are generated on demand from the database rather than stored as files.
- Backups: account records (audit log, payments, organizations) are exported nightly to a private, encrypted bucket and each night’s copy is kept 90 days. No other data is backed up, and the platform does not provide point-in-time recovery.
- Hosting: Vercel, HTTPS enforced, HSTS preload enabled.
Retention
We retain client data for the life of the engagement and 7 years after for audit and compliance evidence purposes (SOC 2, ISO 27001, HIPAA, PCI). You can request earlier deletion at any time — see Section 07.
Security controls
- TLS 1.3 in transit, AES-256 at rest (Supabase default).
- Row-level security (RLS) on every database table.
- SHA-256 hashed API keys (never stored in plain text).
- Service-role keys never used in client-side code.
- CSP, HSTS, X-Frame-Options, strict CORS on the web app.
- Type-check, lint, and the test suite run on every pull request and every push to main.
Your rights — GDPR, CCPA, and data subject requests
These rights apply to all customers. They satisfy the data subject rights granted under the General Data Protection Regulation (GDPR, Art. 15–22) and the California Consumer Privacy Act (CCPA, §1798.100–1798.150). You can, at any time:
- Right of access — request a copy of all data we hold about you or your organization.
- Right of rectification — request correction of inaccurate data.
- Right to erasure (“right to be forgotten”) — request deletion of your account and associated data.
- Right to data portability — receive your data in a structured, machine-readable format (JSON or CSV).
- Right to restrict processing — revoke consent for carrier data sharing or pause processing while a dispute is resolved.
- Right to object — opt out of the onboarding email sequence at any time (unsubscribe link in every email) and decline any non-essential processing.
- Right not to be subject to automated decision-making — readiness scores are advisory; no engagement, insurance, or compliance outcome is determined solely by automation.
Signed-in customers can raise an access/portability (data export) or erasure (account deletion) request directly in the portal at Settings → Privacy; each request is tracked to completion and recorded in the organization’s audit log. Or email privacy@afteraction.dev for any request. We respond within 5 business days. A signed Data Processing Agreement (DPA) is available on request for customers subject to GDPR, UK GDPR, or other regulated-jurisdiction obligations.
Subprocessors
We share customer data with the following subprocessors to deliver the platform. The authoritative list with purpose, data classes, and region is published at /security: Vercel (hosting), Supabase (database + auth + storage), Stripe (payments), Resend (transactional email), Anthropic (AI features — the portal assistant, AAR and deliverable quality review, exercise coaching and report drafting; exercise and report content is sent in prompts and, under Anthropic's commercial terms, is not used to train models), PostHog (product analytics) and Sentry (error monitoring). Material changes are announced 30 days in advance via email to org owners.
Changes to this policy
Material changes are announced via email to org admins at least 30 days before taking effect. The "last updated" date at the top of this page tracks all revisions.
Contact
Questions about this policy, data requests, or security reports: privacy@afteraction.dev
After Action, LLC — a California limited liability company.