Trust Center

Policyflow helps organisations distribute policies and collect employee attestations. Because that data ends up in audit reports and compliance evidence, customers ask us — rightly — where it lives, who can touch it, how long we keep it, and how it can be retrieved or removed. This page is the short answer. For anything not covered here, email hello@applikeable.com.

Compliance posture

“Aligned” is a self-assessment, not certification or an independent audit. Where no third-party report exists, we say so explicitly.

Where your data is hosted

Primary data region

European Union (Frankfurt)

Application hosting

Vercel — configured EU deployment with global CDN for static assets

Database

Supabase managed Postgres with row-level security

Backup and recovery

Managed through Supabase; current configuration is supplied during customer security review

Data residency commitment

Primary customer data is stored in the configured EU database region; application delivery and subprocessors may process request metadata elsewhere

How your data is protected

• Encryption in transit

  All traffic is served over TLS 1.2+ with HSTS. Internal service-to-service calls are encrypted.

• Encryption at rest

  Database storage and file uploads are encrypted at rest using AES-256.

• Row-level isolation

  Every tenant table enforces Postgres row-level security so organizations can never read each other's data.

• Authentication

  Email + password with one-time code fallback. Supabase SSR manages the session cookies used by the browser client; passwords are hashed by Supabase Auth.

• Access control

  Role-based permissions (admin, editor, viewer) gate every mutation. Server actions re-check authorization on each request.

• Audit trail

  Policy edits, approvals, attestations, deliveries, exports, and admin actions are recorded in an immutable audit log with actor, resource, timestamp, and metadata.

• Attestation evidence

  Attestation tokens are cryptographically signed. Each completed attestation captures the policy version, recipient identity, timestamp, and IP for tamper-evident evidence.

• Secret handling

  Directory credentials, SMTP secrets, and API keys are stored encrypted and redacted from all exports and logs.

• Backups

  Database recovery uses Supabase managed backup facilities. Recovery scope and current configuration are confirmed during customer security review rather than promised generically on this page.

• Vendor review

  All subprocessors are reviewed for GDPR compliance, security posture, and data residency before onboarding.

Subprocessors

We share data only with the third parties needed to deliver the service. All subprocessors are bound by GDPR-compliant processing agreements, including Standard Contractual Clauses where data leaves the EEA.

We notify customers of material subprocessor changes at least 30 days in advance. To subscribe to notifications, email hello@applikeable.com.

What we retain

Account data

Retained for the life of the subscription, plus 30 days after cancellation for reinstatement.

Policy content & versions

Retained for the life of the subscription. Each published version is preserved so historical attestations remain verifiable.

Attestation records

Retained for the life of the subscription as compliance evidence. Customers can export at any time.

Audit logs

Retained for the life of the subscription with no rolling deletion.

Email delivery logs

Delivery metadata is retained for up to 12 months. Encoded message bodies and raw provider payloads are retained for up to 30 days, then scrubbed by a scheduled job.

Server & access logs

Retained 30 days for security and reliability investigations.

After account closure

Deletion is handled through a confirmed support request. We acknowledge and scope requests within 30 days, then confirm the deletion date and any remaining managed-backup expiry in writing.

Exporting & deleting your data

Customers can export the full contents of their organisation (policies, attestations, audit log, files) from Settings → Data Export inside the application. The result is a dated TAR archive containing JSON records plus referenced files; directory credentials and access tokens are redacted.

To request deletion of an organisation or of individual personal data records, email hello@applikeable.com. We acknowledge and scope the request within 30 days, verify authority, and confirm completion and any managed-backup expiry in writing.

Every action taken inside Policyflow — policy edits, approvals, attestations, deliveries, exports, admin actions — is recorded in a tamper-evident audit log that admins can filter and export to CSV at any time.

Legal documents

• Privacy Policy

  How we collect, use, and protect personal data.

  Open

• Terms of Service

  The agreement governing your use of Policyflow.

  Open

• Data Processing Agreement (DPA)

  Contact us before subscribing to review and agree the processor terms required for your organization. We do not describe an unsigned or unreviewed draft as a completed DPA.

  Open

• Refund Policy

  How refunds are handled for subscription billing.

  Open

Talk to us

Security review, DPA request, vendor questionnaire, or anything else — write to hello@applikeable.com.