Security and Trust
This page describes how Action Signal protects customer data, and what we have and have not done to date. We would rather tell you plainly than have you discover it in a questionnaire.
What we have not done yet
We are an early-stage company and our security program reflects that. Stating it up front:
- We have not completed a SOC 2 audit and do not currently hold a SOC 2 report.
- We have not commissioned a third-party penetration test.
- We do not hold ISO 27001 or any equivalent certification.
- We have no formal, externally audited incident response program, though we do monitor and alert as described below.
If any of those is a requirement for your organization, tell us at privacy@actionsignal.ai and we will tell you honestly where we are rather than what you want to hear.
Keeping customers separate
The control we have invested in most is workspace isolation, because it is the one that matters most in a platform where several brands’ data lives in the same system. It is enforced in three independent layers, not by convention:
- An automated gate runs on every build, including preview builds, and fails the build if any database read or write can execute without being scoped to a workspace.
- A runtime guard rejects any query that reaches the database without workspace scope, so a mistake that somehow passed review still fails closed rather than returning another customer's data.
- Any access by Action Signal personnel that crosses a workspace boundary is routed through an explicit, logged path, so it is auditable rather than invisible.
We do not use one customer’s content to generate outputs for another customer. That commitment is in our Privacy Policy and in Section 6 of our Terms of Use, and the layers above are how it is enforced rather than merely promised.
Protecting data
- Data is encrypted in transit and at rest.
- Credentials you authorize for connected platforms, such as advertising or commerce accounts, are encrypted at rest in our database rather than stored in readable form.
- Access within a workspace is controlled by role.
- Two-factor authentication is available to every user, and a workspace can require it of its members.
- Product analytics mask form inputs, and are not loaded at all for visitors in the EEA, the United Kingdom, or Switzerland.
Monitoring and availability
- Uptime is monitored by Better Stack, which probes the application and a dedicated health endpoint on a short interval. The health check verifies that the application is running and that the database is reachable.
- Failed probes alert our team in Slack immediately.
- Application errors and performance traces are captured in Sentry.
We do not yet publish a public status page or commit to a contractual uptime target. Both are on the list.
How we build
- Static security analysis runs automatically on every pull request.
- Dependency vulnerabilities are surfaced weekly and patched through automated update pull requests.
- Type checking, the workspace-isolation gate, and the full automated test suite all run before any change can merge.
- We periodically run AI-assisted security review across the codebase. This is a supplement to the automated tooling above, not a substitute for the third-party penetration test we have not yet commissioned.
Who else processes your data
We publish the full list of subprocessors, what each is used for, and what categories of data reach them, in Annex B of our Data Processing Addendum. We commit there to giving notice before adding a new one.
Reporting a vulnerability
If you believe you have found a security issue, email privacy@actionsignal.ai with enough detail to reproduce it. We will acknowledge within three business days. We do not currently operate a paid bug bounty, and we ask that you give us a reasonable opportunity to fix an issue before disclosing it publicly.
Contact
ACTION SIGNAL LLC
2108 N ST STE N
Sacramento, CA 95816
United States