001 / security >>>
Built for the
person asking
"is this safe?"
Tenant isolation enforced at the database. Audit log on every access. PDPA-aligned. SOC 2 in progress.
Where your data lives
Hosted on a managed Postgres database with file storage, in the Singapore region. AES-256 at rest. TLS 1.2+ in transit. No cross-region replication unless you explicitly request it.
Tenant isolation
Every tenant's data is isolated at the database layer via Postgres Row-Level Security. Even if our application code had a bug, the database refuses to return another tenant's data. We run adversarial RLS tests on every deploy.
Authentication
A managed authentication service. JWT-based with HTTP-only cookies. Sign-in via email/password (MFA required for admins) or Google OAuth. Sessions expire on inactivity. Revoke any session from account settings.
Audit logging
Every sign-in, document upload, chat, principle edit, and settings change is logged with actor, timestamp, IP, and metadata. Append-only. Cannot be modified retroactively. Tenant admins query their own audit log. Master admins query everything.
AI usage
We use a managed AI language model provider. Per that provider's policy, your data is not used to train their models. We don't train our own models on your data either. No cross-tenant data sharing.
PDPA compliance
Right of access (export endpoint). Right of deletion (deletion endpoint). Consent withdrawal at any time. Breach notification within 72 hours. DPO reachable at nick@freemansland.co.
002 / sub-processors >>>
Third parties we use.
Listed in our DPA. Each has its own security posture. We don't add new sub-processors without 30 days' notice.
| category | purpose | region |
|---|---|---|
| Managed database, authentication & storage provider | Stores workspace account records, documents, and application data | Singapore |
| AI language model provider | Generates chat answers, boss-voice calibration, AI-generated training content, and quiz feedback | United States |
| Document embedding provider | Converts uploaded documents into a searchable format so the assistant can find relevant passages | United States |
| Frontend hosting provider | Serves the Decisionlore web application | Singapore |
| Error monitoring provider | Captures technical errors so we can fix bugs quickly, where configured for an environment | not yet confirmed |
003 / compliance roadmap >>>
What's next.
004 / faq >>>
Common security questions.
Is this AI training platform PDPA compliant?
Decisionlore is built PDPA-aligned: right of access via an export endpoint, right of deletion via a deletion endpoint, consent withdrawal at any time, breach notification within 72 hours, and a named DPO. We are not yet externally certified against a formal standard like SOC 2, that work is on the roadmap below, but the controls above are live today.
Where is my data hosted? Is there Singapore data residency for this AI software?
Yes for the core platform: your account records, documents, and application data sit on a managed Postgres database with file storage in the Singapore region, AES-256 at rest, TLS 1.2+ in transit. Two sub-processors process data outside Singapore to do their specific job: the AI language model provider and the document embedding provider, both currently United States-based. See the sub-processors table above for the full list.
Is my company's data isolated from other companies on the platform?
Yes. Every tenant's data is isolated at the database layer using Postgres Row-Level Security, so even a bug in our application code can't return another tenant's data. We run adversarial RLS tests on every deploy.
Are you SOC 2 certified?
Not yet. SOC 2 Type 1 readiness is targeted for month 4 to 6 of operation, an external penetration test by an SG-based firm around month 5, and SOC 2 Type 2 by month 10 to 15. See the compliance roadmap above for the current stage, we'll update this page honestly as each milestone actually lands.
005 / report a vulnerability >>>
Found a security issue?
Email nick@freemansland.co. We respond within one business day. We don't pursue good-faith security researchers.