THE STANDUP
CTXWINDOW
AGENTWIRE
BLOCKDEX
COMPOUND
USINGITUP
TRUSTDESKSecurity
Everything on this page is verifiable in the products. No badge we haven't earned, no acronym we can't back.
Data encryption
All traffic between your browser and Compound Labs runs over TLS. Data at rest lives in Postgres on Supabase, encrypted with AES-256 at the storage layer. Secrets and API keys sit in managed secret stores, never in code.
Tenant isolation
Every Compound Labs product runs on Postgres with per-tenant row-level security: every row is scoped to your account and the policy is enforced by the database itself, not by application code. A bug in one app's code cannot read another customer's rows, because the database refuses the query.
Your data is never training data
Explicit pledge: nothing you put into a Compound Labs product is used to train AI models, ours or anyone else's. AI features call model APIs with training on inputs disabled, and in high-stakes workflows (claims, appeals, billing disputes) the AI drafts and you approve; nothing is filed or sent without your review.
Access
You sign in with Google or an emailed magic link, Compound Labs never sees or stores a password. Sessions use short-lived rotating tokens. When you connect an integration, we request the minimum OAuth scopes the feature needs, store the tokens encrypted, and delete them when you disconnect.
Payments
Payments are processed by Stripe. Card numbers go from your browser straight to Stripe and never touch Compound Labs servers. We store only the Stripe customer reference and your subscription state.
Your money stays yours, Compound Labs never holds it
When a Compound Labs app touches money, chasing an invoice, disputing a charge, retrying a failed payment, it helps you collect, but Compound Labs never takes custody of, holds, or moves the money. There is no Compound Labs balance, wallet, or escrow. The money always flows through your own processor, your Stripe, your Square, your invoicing tool, straight into your own account; Compound Labs only ever reads the state and drafts the next step. Every money action is approval-gated by design: a reminder isn't sent, a chargeback rebuttal isn't filed, and a retry isn't run until you approve it. Compound Labs is never a party to a dispute, never a merchant of record, and can't spend, refund, or reroute a cent on its own.
Subprocessors
Every third party that can touch customer data, what it touches, and its own audited security posture. This list is complete, there are no others.
SOC 2 Type II
Database, authentication, and file storage. Every customer row lives here, under row-level security.
PCI DSS Level 1
Payments. Card numbers go from your browser straight to Stripe and never touch Compound Labs servers.
SOC 2 Type II
Product analytics. Usage events only, sent through a first-party proxy, never the contents of your records.
SOC 2 Type II
AI inference (Claude, the primary model rail). Sees only the text a feature sends it, with training on inputs disabled.
SOC 2 Type II
AI inference (secondary rail for specific tasks). Same terms: API inputs are not used for training.
Google Cloud certifications
AI inference (Gemini, for document-reading tasks) with training on inputs disabled, plus a metadata-only usage log, which model, how many tokens, how fast. Never the content.
Microsoft Trust Center
Mailbox send and sync via Microsoft Graph, only after you connect Microsoft 365 yourself, only with the scopes you grant. Tokens are deleted when you disconnect.
Security page
Email delivery fallback when you haven't connected your own mailbox: recipient addresses and message content, in transit.
Security page
SMS delivery, in products that send texts: phone numbers and message content, in transit.
SOC 2 Type II · ISO 27001
Bank connections, in products that offer them and only when you connect an account yourself. Compound Labs stores connection tokens, never your bank credentials.
Where your data lives, and what leaves
Everything you store in a Compound Labs product lives in one place: Postgres on Supabase, hosted in the United States (AWS us-west-2), with files in Supabase Storage in the same project. Data leaves that database only to the subprocessors above, and only to do the job you asked for, a charge goes to Stripe, an email goes through your connected mailbox or Resend, a text goes through Telnyx, a page renders on Vercel, a usage event goes to PostHog through a first-party proxy, and the specific text an AI feature works on goes to a model API with training disabled. Nothing else leaves. No ad pixels inside the products, no data brokers, no resellers. Retention is simple: your data lives as long as your account does, and deletion on request completes within 30 days.
GDPR & CCPA
Export is self-serve: every product has a full-account export in settings, one click, one file with every row you own, no email required. Deletion completes within 30 days of a request to hello@thecompound.tech, across every product. Compound Labs does not sell personal data and never has; in CCPA terms, we do not sell or share personal information, period. Data is stored in the United States (Supabase, AWS us-west-2). If your GDPR paperwork needs a signed data-processing agreement, email hello@thecompound.tech and you'll get one.
Data deletion
Email hello@thecompound.tech and your data is deleted within 30 days, every row scoped to your account, across every Compound Labs product. No retention games, no exit interview.
The security questionnaire, answered
The questions every reviewer asks, answered in plain language. Send this page instead of a spreadsheet, or email hello@thecompound.tech and the questionnaire comes back filled in.
Is data encrypted in transit?
Yes. TLS on every connection, your browser to Compound Labs, and Compound Labs to every subprocessor above.
Is data encrypted at rest?
Yes. AES-256 at the storage layer for both the database and file storage.
How is access controlled?
Row-level security scoped to your account, enforced by Postgres itself. Sign-in is Google or an emailed magic link, Compound Labs never sees or stores a password. Integrations get the minimum OAuth scopes, tokens stored encrypted and deleted on disconnect.
Is there MFA on admin surfaces?
There is no Compound Labs-built admin panel to breach. Operational access runs through the vendors' own consoles, Supabase, Vercel, Stripe, under a single operator identity, so the access list is one line long and audits itself.
Are there backups?
The database is managed Postgres on Supabase, with durability handled at the platform's storage layer, and you always hold your own copy: every account can export all of its data from settings, any time, in one click.
What is the incident response plan?
If an incident touches your data, you hear about it directly and fast, from the person who wrote the code. Reports to hello@thecompound.tech get a human reply, usually the same day.
Who are the subprocessors?
The ledger above is the complete list. There are no others.
How is data deleted?
Email hello@thecompound.tech and every row scoped to your account is deleted within 30 days, across every Compound Labs product.
How are tenants isolated?
Per-tenant row-level security in Postgres. The database refuses cross-tenant queries, so isolation doesn't depend on application code being bug-free.
Is customer data used to train AI models?
No. Never. Model APIs are called with training on inputs disabled, and nothing you store here trains anything, ours or anyone else's.
Continuity
Compound Labs is small by design and run by the product itself. Signup, billing, provisioning, the AI work, even the changelog, automated end to end, with every deploy logged as it happens, not written up after. If the founder is unavailable for a week, the products keep charging, drafting, chasing, and filing without noticing. And you are never locked in on trust alone: export all of your data self-serve at any time, cancel your subscription at any time, and deletion on request completes within 30 days.
Responsible disclosure
Found a vulnerability? Email hello@thecompound.tech with details and steps to reproduce. Reports get a human reply, usually the same day, because the human who replies is the one who wrote the code.
What we don't have yet
We don't hold a SOC 2 certification, and the trigger for buying one is written down: the week the first 50-plus-employee prospect, Clio-channel firm, or channel partner asks for it, the audit gets purchased. When it lands, it gets added to this page, not before. Everything above applies to every byte you store here today, certificate or not.