Your data is protected.
And we can prove it.
soyes.ai is a startup. We don't have a SOC 2 Type 2 certificate yet — but we hold ourselves to the same standards and can document every control on request.
EU Data Residency
All application data is stored on a Contabo server in France. Nothing leaves the EU without your knowledge.
Encrypted in Transit & at Rest
TLS everywhere via Cloudflare. Secrets encrypted with sops/age. Offsite backups AES-256 encrypted.
Hardened Infrastructure
CSP enforcing, HSTS, X-Frame-Options DENY, UFW firewall, fail2ban, SSH key-only access.
Access Controls
RBAC with four roles, Google SSO, httpOnly cookie auth, separate superadmin domain, forced password rotation on provisioning.
Right to Erasure
GDPR Art. 17 erasure fully implemented. We erase a customer's data across all stores on request within 72 hours.
Daily Backups + PITR
Daily offsite backups + 8-day PostgreSQL point-in-time recovery window. Restore drill last passed 28 July 2026 (restic snapshot restored, tenant config parsed, pg_dumpall header verified).
Automated security scanning
Bandit, Gitleaks and dependency audits run on every push (blocking). Semgrep runs as a periodic full scan, not per-push.
153 files scanned · 164 rules · 0 real findings
Last full scan: June 2026 · Pinned rule set: semgrep/semgrep-rules@48a4fdb
Clean since Phase 1 hardening · Runs on every push to master
Full commit history scanned · Blocking on any finding
Python + all five frontend apps checked · Results surfaced in CI log
Sub-processors
These are the third-party services that may process your customers' data on our behalf.
In plain language: we deliberately use a broad range of AI models rather than a single vendor, so that no one provider can take the service down or price it out. That means a message may be processed by a model operated outside the EU — including in the United States and in China. We name every such provider in the table below, and a customer on a plan that requires it can ask us to disable any of them for their account.
| Sub-processor | Purpose | Data location |
|---|---|---|
| Contabo GmbH | Hosting / infrastructure | France (EU) |
| Google (Gemini API) | AI model inference | Per Google terms (US / global) |
| DeepSeek | AI model inference (primary text model) | China — transfer under Standard Contractual Clauses |
| OpenRouter | AI model inference (routing to third-party models) | US / mixed, per routed model |
| Groq | AI model inference (low-latency fallback) | United States |
| Cohere | Text embeddings for knowledge-base search | Per Cohere terms (US / EU) |
| Cloudflare | WAF / CDN / TLS | Global edge (metadata only) |
| Paddle | Payments (Merchant of Record) | Per Paddle terms |
| Microsoft (OneDrive) | Encrypted offsite backups | Per operator M365 tenant |
SOC 2 readiness
Scored against Security (CC1–CC9), Availability, Confidentiality, and Privacy criteria.
55 controls implemented · 22 partial · 0 gaps.
Full documentation and evidence index available on request. Formal SOC 2 Type 2 audit is on our roadmap as we scale.
Need our security documentation?
We can share our full SOC 2 self-assessment, DPA template, or answer your vendor security questionnaire.