Security

AugmentWorks handles sensitive policies, traces, and system descriptions during assessments. This page describes current security practices. It is not a certification, audit report, or compliance attestation.

We collect only what is needed to scope and deliver an engagement. Prefer staging environments, synthetic data, and redacted traces when possible. Do not submit production credentials or customer PII through the public contact form.

Submissions are stored in Supabase. Notification emails contain only a lead ID, company, and work email—not workflow details. Rate limiting uses a daily rotating one-way IP hash; raw IP addresses are not stored in lead records. Field length and enum validation is enforced server-side.

Client portal access is invite-only. Users authenticate via Supabase Auth. Organization membership controls which engagement data is visible. Administrative actions use service-role credentials server-side—not from the browser.

Client files and deliverables are stored in private Supabase Storage buckets with access policies tied to organization membership. Data is encrypted in transit (TLS) and at rest by infrastructure providers.

Assessment artifacts are retained according to the applicable engagement terms and operational, security, accounting, dispute, and legal needs. Clients may request deletion after delivery subject to those obligations and backup cycles.

Portal sign-ins and administrative actions may be recorded for accountability. Public-site analytics use named events and masked session replays on marketing pages; autocapture is disabled. Application conversation content or report bodies where feasible.

We use service providers for hosting, database, authentication, storage, email notifications, and limited public-site analytics. See the current service provider and subprocessor list for their purposes and the data involved.

When an engagement includes executing scenarios against a client system, prompts and outputs may be processed by a model provider designated or approved by the client. The provider and data treatment are documented in the engagement scope or data-processing terms. Model providers are not used to process public contact-form submissions.

Report suspected security issues to hello@augmentworks.ai. A machine-readable policy is also available at /.well-known/security.txt.

AugmentWorks does not currently hold SOC 2, ISO 27001, HIPAA, or FedRAMP certifications. Assessments are not penetration tests of your infrastructure.