Trust

How Vaulith handles your evidence

Draft, 17 September 2026 · reviewed at each release

The central finding Vaulith produces is that vendors cannot name the third parties inside their own product. It would be indefensible to sell that and decline to answer it ourselves, so this page is the register we would want from you.

Subprocessors

Supabase. Postgres, authentication and object storage. United States. Holds profile content, evidence artifacts and the account email address.
Netlify. Static application hosting, CDN and form handling. United States. Serves the application and holds what is typed into the forms: an enquiry, or an email address left to be contacted. It holds no profile content and no evidence.
Stripe. Payment processing. United States. Holds the card and billing details for an assessment purchase, and the receipt. Vaulith never sees the card number.
Resend. Transactional email. United States. Delivers sign-in links and purchase receipts, so it holds the email address and the text of those messages. Nothing from a profile is ever in an email.

No model provider is in this list. The findings engine is a deterministic rules set, not a language model, so your evidence is not sent to any inference provider to be assessed. If that changes, this page changes first and affected customers are notified before it takes effect.

Access controls

Every table enforces row-level security scoped to your organisation, and the anonymous role holds no privilege on any of them, not even a filtered one. Verified against a real database on every build, including that it cannot truncate a table, which row policies do not cover.
A carrier reviewer reads a shared profile through a single privileged database function, never through table access, which enforces expiry, revocation and redaction server-side.
Share tokens are stored only as SHA-256 digests. A disclosure of our database yields no working share links.
An evidence artifact you have recorded as containing third-party personal data is withheld from sharing by the server, not filtered by the browser. Nothing scans the document; the record is yours.

What a reviewer can and cannot see

A reviewer sees your model records, the security posture you entered, your responses and the cited passages behind them, and a note of what changed since they last opened the link. The evidence list and the passages open only after the reviewer acknowledges confidentiality, and that acknowledgement, every open, every download and every question is recorded for you. A reviewer never sees your readiness score or your gap report. Those are your private diagnostic of your own weaknesses, and disclosing them to the party assessing you would make the product unusable.

Incident notification

We will notify affected customers without undue delay and in any event within seventy-two hours of confirming an incident affecting their content, with what we know, what we are doing, and what we recommend you do.

Accessibility

We are building to WCAG 2.2 Level AA and we do not yet claim conformance. What is in place today: every interactive surface works with a keyboard alone, focus moves to the new content when a page or a question changes, progress is exposed to assistive technology as progress, and every animation is removed when your system asks for reduced motion. What is not yet in place is an independent audit and a conformance report. If you meet a barrier anywhere on this site, write to support@vaulith.com and we will fix it rather than explain it.

What we have not done yet

Vaulith is early. We do not hold a SOC 2 Type II report, we have not completed an independent penetration test, and the data processing addendum at /legal/dpa is a draft that has not yet been through counsel. Stating that plainly is the same discipline the product asks of you: an undisclosed gap costs more than a disclosed one.