Security & Trust

Moistur AI is built so that the access-control and audit foundations enterprises expect are in place from the start. We are transparent about what we have today versus what is still on our roadmap: this page reflects controls that actually run in production, not aspirations. If a control is listed below, it is live.

We are an early-stage company building toward formal certification. We will not claim a certification we do not hold.

• SOC 2: Not certified. We maintain an internal readiness mapping of our controls to the SOC 2 Trust Services Criteria. No auditor is engaged and no report is available.
• ISO 27001: On our roadmap; work has not yet started.
• GDPR, India DPDP, and CCPA: We align our data-handling practices with these regimes. See our Privacy Policy for data rights and transfer safeguards.

Enterprise prospects in active evaluation can request our current security overview and a mutual NDA at support@moistur.ai.

The following controls run in production today:

• Encryption in transit and at rest: All traffic is served over TLS, and data is encrypted at rest by our managed infrastructure providers.
• Tenant isolation: Each customer's data is separated at the database layer using Postgres row-level security, enforced on org-scoped tables.
• Role-based access control: Granular roles (owner, admin, member, viewer) are enforced at both the application and database layers.
• Audit logging: Security-relevant events are written to an append-only audit trail with IP and user-agent provenance. Organization admins can view and export their own logs.
• Secrets isolation: Service credentials and AI-provider keys are held server-side only and are never exposed to the browser.
• API key hygiene: Personal API keys are stored only as SHA-256 hashes and are shown to you once, at creation.
• Verified webhooks: Inbound payment and email webhooks are signature-verified before processing.
• Monitoring with PII scrubbing: Errors are tracked centrally, with personal data and secrets scrubbed before transmission.
• Daily backups: Our database is backed up daily by our managed database provider.

These providers receive customer or personal data to operate the Service:

• Infrastructure: Vercel (hosting and performance monitoring) and Supabase (database, authentication, file storage). Our production database (Supabase, AWS ap-southeast-1) and application servers (Vercel, sin1 region) are located in Singapore.
• Caching and rate limiting: Upstash (Redis).
• AI and search providers, to run your prompts: OpenAI, Anthropic, Google (Gemini), Perplexity, and SerpAPI (which retrieves Google AI Overviews, Google AI Mode and Microsoft Copilot results); xAI (Grok) for workspaces with the Grok add-on.
• Machine-learning processing: Modal, which runs our embedding, sentiment and anomaly models on scan results.
• Payments: PayPal (USA). We never store full card numbers.
• Email: Resend (USA), for transactional and bulk email.
• Error tracking: Sentry (USA), with PII scrubbed before transmission.
• Analytics: PostHog (USA) for product analytics, and Google Analytics for website analytics.
• Bot protection: Cloudflare Turnstile, on sign-in and sign-up.
• Demo booking: Calendly, when you open the booking form, including any text you typed into the homepage prompt box.
• News monitoring: Google News, which receives your brand and industry keywords to find related coverage.

Integrations you connect (Slack, Microsoft Teams) send data to the destinations you choose. The same list appears in our Privacy Policy. We do not sell your personal information.

Our production database (Supabase, AWS ap-southeast-1) and application servers (Vercel, sin1 region) are located in Singapore. Requests first reach Vercel's edge network at the location nearest you. We retain your data while your account is active and honor deletion requests as described in our Privacy Policy, which also covers data-subject rights and international transfer safeguards. We do not use your proprietary prompts or data to train public AI models.

We welcome responsible disclosure. If you believe you have found a vulnerability, please email support@moistur.ai with details and reproduction steps. Please give us a reasonable window to investigate and remediate before any public disclosure, and avoid accessing or modifying data that is not yours.

Machine-readable contact details are published at /.well-known/security.txt.