Security

TLS 1.2+ in transit on every customer-facing endpoint.

At-rest encryption on Supabase-backed Postgres.

Application-layer AES-256-GCM for HubSpot access and refresh tokens before they reach the database. Tokens are never logged in plaintext.

Supabase Auth with secure cookies. Email-based password reset.

OAuth-based HubSpot connection with state validation tied to the session user.

Session secrets are rotated.

Workspace-scoped access controls. Membership roles: OWNER, ADMIN, EXPERT, MEMBER, CLIENT_VIEW.

Mutating routes verify CSRF and check membership and role before acting on data.

App: Vercel. Database: Supabase Postgres. Background jobs: Inngest. Email: Resend.

Each customer’s data is logically isolated by workspace ID; queries are scoped at the application layer with row-level guards in the database where applicable.

Application errors are logged in our error log table and forwarded to our monitoring stack. Customer credentials are never logged.

Administrative events, versioned legal acceptance, security-sensitive account recovery, and customer data requests are recorded for investigation and evidence.

Production database backups run daily with 7-day retention on managed infrastructure. Point-in-time recovery and extended retention are being evaluated as part of our SOC 2 readiness work. Details available on request: hello@ancil.ai.

Reported security events are triaged promptly under a documented incident-response and escalation process. Confirmed Personal Data Breaches are communicated to affected customers without undue delay, with available facts and updates as the investigation progresses.

Response procedures cover containment, evidence preservation, severity classification, internal and external communication, recovery, and post-incident corrective action.

SOC 2 Type II readiness and observations are in progress. Ancil does not represent that certification as complete. The current security posture, provider register, and a vendor questionnaire are available under confidentiality at security@ancil.ai.

Security verification includes dependency review, static analysis, focused security tests, access-control checks, and production readiness gates. Independent penetration testing remains a separate assurance activity.

Email security@ancil.ai. We will acknowledge within 2 business days. We do not yet operate a paid bug bounty; we are happy to credit researchers who follow responsible disclosure.