Security & Trust — SAIG

An honest overview of the security controls SAIG implements today.

Last Updated: July 20, 2026

Security | Privacy | Terms

What we implement today

Multi-tenant data isolation

Customer data is isolated at the database layer using PostgreSQL Row-Level Security (RLS). Every tenant-scoped table enforces organization membership before rows can be read or written. Application code additionally scopes queries by org_id for defense in depth.

Authentication & identity

• Supabase Auth with unique user IDs (UUID) and email verification
• JWT-based session tokens validated on every serverless function call
• Role-based access: user, employee, admin, and platform admin roles
• Two-factor authentication (TOTP) required for platform admin accounts
• 3-hour client idle session timeout with automatic sign-out
• OAuth sign-in (Google) with PKCE for social connections

Encryption

• In transit: All traffic uses HTTPS/TLS between your browser, our app, and our infrastructure providers
• At rest: Database and file storage encryption is provided by our hosting infrastructure (Supabase/AWS)
• Payments: Card data is handled entirely by Stripe — SAIG never stores full card numbers

SAIG does not currently implement application-layer field encryption (e.g. pgsodium) for stored API keys or credentials. Credentials in the API Vault are org-scoped via RLS and masked in the UI.

Application security

• HTML sanitization (DOMPurify) on user-generated rich content
• Webhook signature verification (Stripe, Square, AWS SNS)
• Production builds strip console output to reduce accidental data leakage
• Automated dependency updates via Dependabot
• Unit and end-to-end tests including tenant isolation checks

Audit logging (partial)

SAIG logs selected security-relevant events including email sends, payment webhooks, voice commands, and platform admin actions. Audit logs are org-scoped and not publicly immutable/WORM-certified. We are working toward stronger audit retention and immutability controls.

Marketing & outreach compliance

• Email and phone suppression lists (CAN-SPAM / TCPA-aware outreach modules)
• Automated content compliance scanning for social and ad copy

Sub-processors

SAIG uses the following third-party services to operate the platform. Each processes data only as needed to provide the Service. Contact info@saigtech.com for a signed DPA or sub-processor questions.

Data residency

The Service is hosted in the United States. If you access SAIG from outside the U.S., your data will be transferred to and processed in the U.S. For EU/UK users, we rely on Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework for lawful transfers. See our Privacy Policy for details.

Responsible disclosure

If you discover a security vulnerability, please report it to info@saigtech.com with the subject line "Security Report". We will acknowledge receipt within 5 business days and work to remediate verified issues promptly.

What we are working toward

• SOC 2 Type I / Type II readiness program
• Immutable audit log retention
• Automated GDPR data subject request workflows
• Application-layer encryption for sensitive credential fields
• Enterprise SSO (SAML/OIDC)

© 2026 SAIG. All Rights Reserved.