Trust & Security
Last updated: September 6, 2026
ADLR is the operating system your business runs on. That comes with a responsibility to handle your data carefully and transparently. This page documents where we are with each commitment — green means done, amber means in flight, blue means planned and timed. Ask us for a copy of any report at security@adlr.app.
Certifications & compliance
SOC 2 Type I
Auditor engaged. Type I report scheduled Q3 2026. Pre-audit gap analysis complete.
SOC 2 Type II
Observation period begins immediately after Type I sign-off.
GDPR (EU)
DPA available on request. EU data subjects can exercise access, deletion, and portability rights via privacy@adlr.app.
CCPA (California)
California residents: we honor right-to-know, right-to-delete, and opt-out of sale. We do not sell personal data.
HIPAA
BAA available on enterprise plans in Q4 2026.
Encryption & data handling
Encryption in transit
TLS 1.2 or newer on every request (TLS 1.3 negotiated by modern clients); TLS 1.0 and 1.1 are rejected at the edge.
Encryption at rest
AES-256 everywhere: the database and its backups use AWS KMS-managed keys; S3 object storage (documents, mail archives, inbound mail) uses S3-managed server-side encryption.
Data residency
All data is stored in AWS us-east-1 (Virginia) today, with automated database backups replicated to us-west-2 for disaster recovery. An EU region for residency requirements is planned for enterprise plans; it is not available yet.
Backups
Encrypted automated backups. Database point-in-time recovery for 14 days; workspace email archives on a 90-day rolling retention window (the most recent snapshots are kept for disaster recovery).
Deletion
Account deletion purges workspace content within 30 days. Database backups expire on the rolling 14-day window, and verified full erasure — including every backup archive — is available on request.
Access & account security
Two-factor auth
TOTP with one-time recovery codes, available on every account from Settings → Security (passkeys are offered on meetings.adlr.app Rooms accounts). Workspace owners can require a second factor for every member; unenrolled members are held at enrolment until they have one (SSO-only workspaces defer to the identity provider); API tokens and connected apps are not held.
SSO (SAML 2.0)
SP-initiated SAML 2.0 single sign-on, configurable by the workspace owner in Settings → Security, with optional SSO-only mode and a break-glass emergency access path. SCIM user provisioning is supported. OIDC is not available.
Password hashing
bcrypt (cost factor 12) with per-user salts. No passwords stored in plaintext or reversible form.
Session management
Signed JWT sessions with a 7-day lifetime — when it ends you sign in again; workspace owners can cap the lifetime (1–720 h) and members are held to it at every request. Revoking a user's sessions (offboarding, deactivation, SCIM deprovision, or self-service “sign out other devices”) takes effect within 30 seconds.
IP allowlisting
Workspace owners can restrict sign-in and use to listed IPv4/IPv6 addresses or CIDR ranges (Settings → Security). The client address is taken from the edge-verified proxy chain, so it cannot be spoofed by a forged X-Forwarded-For header. API tokens and connected apps are not subject to the list.
Vendor access
ADLR platform staff can act inside a workspace only with a stated reason and full audit attribution; workspace owners can additionally require their explicit approval — a time-boxed window granted from Settings → Security — before staff can act as a user or exercise permissions inside the workspace, and staff-minted API tokens expire within 90 days.
Audit logs
Workspace actions are written to a tamper-evident, hash-chained audit log. Recent events are visible in Settings → Security, and your own audit history is included in the GDPR data export.
AI data policy
No training on your data
Anthropic and OpenAI are contractually prohibited from training on your workspace content. Content is processed to return a result, then discarded by the provider.
Opt-out
Workspace owners can disable AI features globally from Settings — every AI endpoint checks the switch. Individual autonomous agents can be switched off for the whole workspace from the Agents page.
Prompt logs
When the AI executes an action on your behalf, the triggering prompt is written to your workspace audit log — truncated to 500 characters and PII-redacted first. AI replies are not logged. Audit entries are retained for two years (seven years for finance events), and each one — in the dashboard feed, the Audit Trail, and its CSV export — is readable only by people who can access the module it came from; a viewer without finance access never sees finance activity.
Infrastructure & availability
Hosting
AWS end to end — S3 + CloudFront for the application edge, EC2 for the API, Postgres on RDS (Multi-AZ). Single region (us-east-1) with cross-region backup replication; zero-downtime blue/green API releases.
Uptime target
99.9% monthly uptime target. ADLR is sold on a single custom plan, so this target applies to every workspace — there are no tiered uptime commitments.
Incident response
Notify affected customers within 72 hours of confirmed security incident. Postmortem within 7 days.
DDoS protection
AWS Shield Standard on every public endpoint (the CloudFront edge and the API), with per-identity API rate limiting.
Sub-processors
We share limited data with vetted providers only as needed to run the Service. You will be notified 30 days before any material change.
- Amazon Web Services — hosting, storage, CloudFront edge delivery of the frontend, email (SES), and our own LiveKit server for chat calls and meetings. US regions only; an EU region is not available yet.
- Stripe — payments and subscription billing. Card numbers never touch our servers.
- Resend — email delivery: sign-in codes, notifications, and mail workspaces send from their own domains.
- Anthropic — Claude LLM inference for AI features. Zero-retention agreement.
- OpenAI — fallback LLM inference for AI features (zero-retention agreement), and speech to text for Adi’s voice input.
- Deepgram — speech: Adi’s spoken replies (text to speech) and live meeting captions (speech to text).
- Twilio — phone calls placed from ADLR: call audio and the numbers dialled.
- Telnyx — phone calls placed from ADLR, and internal call testing: call audio and the numbers dialled.
Report a vulnerability
Found something off? Email security@adlr.app with details. We respond to security reports within 48 hours and publicly credit reporters who follow responsible disclosure.
Questions
For questionnaires, DPA, BAA, pen test summaries, or any compliance artifact, email security@adlr.app. Typical turnaround is 2 business days.