Trust Center

Everything a procurement or security team needs to evaluate EM3A. Maintained by ShiftNode Digital s.r.o.. Last updated August 9, 2026 · v2.2.0.

Editable content notice. This page is maintained by ShiftNode Digital s.r.o. to answer common security and privacy questions about EM3A. It is not an independent attestation. ShiftNode Digital s.r.o. does not currently hold SOC 2 Type II or ISO/IEC 27001 certification; the controls described below reflect operational practices modelled on those frameworks. Signed agreements (MSA, DPA, SLA) control over this public copy.

Request a signed DPA

Email legal@em3a.ai — we counter-sign within 3 business days.

Email legal

Read the full DPA

GDPR Art. 28, SCCs (Modules 2 & 3), UK IDTA Addendum included.

Open DPA

Report a vulnerability

Coordinated disclosure — 90-day window before publication.

Email security

Shipped controls

Tenant isolation

Row-Level Security on every tenant table; server-side enforcement via SECURITY DEFINER helpers scoped to org_id.

Authentication & MFA

Email/password + Google OAuth. Optional TOTP MFA with backup codes; per-org MFA enforcement policy with grace window and hard gate on sensitive routes.

Session hardening

30-minute idle timeout, 12-hour absolute session ceiling, per-user 'Sign out from all devices' revoking every refresh token.

Tamper-evident audit logs

SHA-256 hash-chained rows in user_activity_audit, admin_audit_log, and org_audit_log. verify_audit_chain() RPC detects any insert, edit, or reorder.

SIEM export (Enterprise)

Signed webhooks fan out audit events every 5 minutes to Enterprise-entitled subscribers (audit.user_activity / .admin_action / .org_event).

Retention & 30-day deletion

Daily purge of operational logs (90d/180d windows). User-initiated account deletion is queued and hard-deleted after 30 days by an hourly worker.

Companion documents

Security & Trust — controls in depth Subprocessors — who touches your data Data Processing Agreement (GDPR Art. 28)Service Level Agreement — uptime & remedies Privacy Policy — GDPR / UK GDPR / CCPA Terms of Service

Pre-answered security questionnaire

SIG-Lite / CAIQ-Lite shape

Covers the questions we most often see in mid-market and SME vendor reviews. Need the full SIG or CAIQ workbook? Email security@em3a.ai.

Governance & Compliance

Access control & identity

Data protection

Application & AI security

Operations & incident response

Questionnaire (full text)

Governance & Compliance

Q. Do you hold SOC 2, ISO 27001, or equivalent certifications?

A. No. EM3A is operated by ShiftNode Digital s.r.o. and does not currently hold SOC 2 Type II or ISO/IEC 27001 certification. Our security programme is modelled on those frameworks and documented on the Security page. A published roadmap for third-party attestation is available on request via security@em3a.ai.

Q. Where is the Data Processing Agreement (GDPR Art. 28)?

A. The standard DPA — including SCCs and the UK IDTA Addendum — is at /legal/dpa. A counter-signed copy can be issued by emailing legal@em3a.ai.

Q. Where can I see your sub-processors?

A. The current list is at /legal/subprocessors with purpose, hosting region, and transfer mechanism for each entry.

Access control & identity

Q. How are user accounts authenticated?

A. Email/password and Google OAuth via the managed auth service. Passwords are bcrypt-hashed by the auth provider; the app also applies a strength policy (min 8 chars + character-class rule) both client- and server-side.

Q. Is multi-factor authentication supported?

A. Yes. TOTP factors with backup codes. Workspace admins can require MFA organisation-wide with a configurable grace period; sensitive routes are hard-gated by MfaPolicyGate.

Q. Are sessions bounded?

A. 30-minute idle timeout and a 12-hour absolute session ceiling regardless of activity. Users may revoke every session across every device from Settings → Security.

Q. How is role-based access enforced?

A. Roles live in a dedicated user_roles table (never on profiles) and are checked via SECURITY DEFINER helper functions to prevent recursive RLS. Workspace roles (super_admin, admin, member, viewer) are enforced by RLS + server-side capability checks.

Data protection

Q. Is data encrypted in transit and at rest?

A. In transit: TLS 1.2+ everywhere (HSTS enforced on the primary domain). At rest: AES-256 on the managed Postgres storage layer via the platform provider. Application-level secrets are held in the managed secret store, never in source.

Q. How is tenant data isolated?

A. Every tenant-scoped table carries org_id and enforces a consolidated *_scoped_select RLS policy plus insert/update checks. Cross-tenant reads are impossible without a service-role token, and service-role usage is inventoried in docs/hardening/service-role-inventory.md.

Q. What data-retention windows apply?

API request logs, edge function errors, login attempts, notification delivery log: 90 days.
Read notifications and email send log: 180 days.
Tamper-evident audit logs: retained for the life of the workspace.
Account-deletion requests: hard-deleted 30 days after submission.

Q. Can we export our data?

A. Yes. CSV/PDF export is available from the product UI for projects, contacts, workflows, and analytics. A full workspace export can be requested from privacy@em3a.ai.

Application & AI security

Q. Do you run inputs through an AI model? What is the retention policy at that model?

A. Yes — model calls route through the managed Lovable AI Gateway. We ask the gateway subprocessor to enforce zero-data-retention with its upstream model providers. Model providers do not receive raw auth.users rows; we send scoped project context only.

Q. Are edge function inputs validated?

A. Yes. All request bodies use Zod schemas from _shared/api-validation.ts before execution. SSRF is blocked server-side via assertSafeWebhookUrl. No user-provided SQL is ever executed.

Q. How are API keys and webhook secrets protected?

A. API keys are SHA-256 hashed at rest, rotated via rotate-api-key with an optional grace window. Webhook payloads are signed t=<ts>,v1=<hex> over ${ts}.${body}, and retried with exponential backoff by webhook-retry-worker.

Operations & incident response

Q. What is your breach notification SLA?

A. ShiftNode Digital s.r.o. commits to notifying affected customer contacts within 72 hours of confirming a personal-data breach, in line with GDPR Art. 33.

Q. How do you monitor for tampering?

A. The three audit-log tables are hash-chained. Any authorised operator can run select * from verify_audit_chain('admin_audit_log'); and receive ok = true or the first broken link. Enterprise subscribers can also stream audit events to their own SIEM in real time.

Q. How do we report a suspected vulnerability?

A. Email security@em3a.ai with reproduction steps. Business-hours acknowledgement within 1 business day; on-call rotation covers out-of-hours triage for confirmed High/Critical reports.

Talk to a human

Procurement / DPA

legal@em3a.ai

Privacy

privacy@em3a.ai

Security

security@em3a.ai