Built by security operators.
Defended like one.
After Action holds itself to the same standards we help our clients meet. This page documents every control we enforce, the frameworks we align to, and how to reach us if you find something we missed.
Platform controls
Every control listed is enforced in production today.
Encryption in transit & at rest
TLS 1.3 on every connection with HSTS preload. AES-256 at rest on all Postgres tables and Supabase Storage buckets. No plaintext secrets anywhere in the stack.
Row-level security on every table
Every database table enforces row-level security policies. Users can only read data from organizations they belong to. The service-role key is never used in client-side code.
Hashed API keys
Carrier API keys are SHA-256 hashed before storage. We never see or store the plaintext. Rotation is self-service and takes effect immediately.
Authentication via Supabase
Email + password with bcrypt hashing or a magic link, plus optional TOTP two-factor that an organization can require for every member. Session cookies are Secure + SameSite=Lax and refreshed by Next.js middleware; platform cookies are HttpOnly, while the sign-in session is readable by our own front-end code, as Supabase Auth requires.
Data residency you control
Customer data is hosted on Supabase in the US and never moved across regions. Backup coverage and retention are described in the privacy policy. EU/APAC hosting is on the roadmap for enterprise deployments.
Immutable audit log
Sensitive mutations — team and role changes, exercise creation and completion, deliverable generation, certificate share links, audit-log exports, sign-outs — are written to an append-only audit_log table with actor, timestamp, and the values written (plus the prior values where the route captures them). Only the service role can write it — row-level security blocks every user-facing path — and no application path deletes or edits a row.
Infrastructure hardening
CSP, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, strict CORS, Permissions-Policy disabling camera/mic/geolocation. Deployed on Vercel with automatic TLS.
Vulnerability management
Type-check, lint, and the unit and integration suites run on every pull request and every push to main; production errors are captured in Sentry and surfaced on an internal platform-health dashboard. Security reports acknowledged within 24 hours.
Session controls
Idle timeout enforced per organization (12h default, configurable to 30 minutes), sign out everywhere from any device, and admin-forced sign-out of a teammate for a lost laptop or a departure. Every session action is audited.
Audit log export
Team admins export their organization’s complete audit trail as CSV or JSON at any time (formula-injection-safe). Retained for the life of the organization and at least seven years after; never pruned automatically. Exported copies are yours to retain on your own schedule.
Data rights in-product
Data export and account-deletion requests are raised from Settings → Privacy, tracked to completion on a 30-day statutory clock, and recorded in the audit log — GDPR Art. 15/17/20 and CCPA §1798.100–.105.
Compliance posture
What we've achieved, what's on the roadmap.
| Framework | Posture | State |
|---|---|---|
| SOC 2 Type II | Not certified — control mapping on request | roadmap |
| NIST 800-61 rev 3 | Aligned | live |
| NIST CSF 2.0 | Mapping engine built-in | mapped |
| ISO 27001:2022 | Mapping engine built-in | mapped |
| HIPAA | Mapping engine built-in | mapped |
| PCI-DSS 4.0 | Mapping engine built-in | mapped |
| CIS Controls v8 | Mapping engine built-in | mapped |
| CMMC Level 2 | Mapping engine built-in | mapped |
| SSO (SAML / OIDC) | Not yet available | roadmap |
| MFA (TOTP authenticator apps) | Available — org-wide enforcement per organization | live |
A signed Data Processing Agreement (DPA) is available on request — email privacy@afteraction.dev with your legal team's template or ask for ours.
Security questionnaire answers (CAIQ / SIG Lite style) are available on request — email security@afteraction.dev.
Subprocessors
Every vendor that touches your data.
We list every subprocessor that processes customer data on our behalf, what they do, and where the data lives. Material changes are announced 30 days in advance via email to org owners.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Vercel | Hosting + edge CDN | Application HTTP traffic, logs | US (global edge) |
| Supabase | Postgres + Auth + Storage | All customer data | US |
| Stripe | Payments + billing | Name, email, billing address; PCI handled by Stripe | US |
| Resend | Transactional email | Recipient email + email content | US |
| AnthropicCommercial API terms: inputs are not used to train models. A rule-based engine takes over if the AI is unavailable. | AI features — portal assistant, AAR and deliverable quality review, exercise coaching, report drafting | Exercise, AAR and deliverable content included in prompts | US |
| PostHog | Product analytics | User ID + email, page and feature events, session replays with every form input masked | US |
| Sentry | Error monitoring | User ID + email, error stack traces and request context | US |
Responsible disclosure
Found something? Tell us.
Email security@afteraction.dev with reproduction steps. We acknowledge every report within 24 hours and will keep you updated until it's resolved. We do not pursue legal action against good-faith researchers who follow this policy.
Machine-readable contact: our RFC 9116 security.txt carries the same address, policy link and expiry so scanners and researchers find it without reading this page.
Customer breach notification: If After Action experiences a confirmed security incident affecting customer data, we notify affected org owners by email within 72 hours of confirmation, with what we know, what we're doing, and what you should do. We send the first update even when we don't yet have the full picture — clarity beats speed only after the first message lands.
Security reports
security@afteraction.devPrivacy requests
privacy@afteraction.dev