Supabase
Stores workspace data · us-east-1
SOC 2 Type IIISO/IEC 27001
Google Cloud
Runs application services and simulation jobs
SOC 2 Type IIISO/IEC 27001
Vercel
Serves the web application
SOC 2 Type IIISO/IEC 27001
Stripe
Processes payments · card details do not pass through our servers
PCI DSS Level 1SOC 2 Type II
These audits and certifications apply to our service providers, not to SAPIENSQ. Institutional plans use isolated data environments: Analyst uses a dedicated database on the institutional cluster, while Desk and Institution use dedicated projects with their own databases.
Simulation inputs are processed through the Google Gemini API and, under our current configuration, are not used for model training. They may be retained for up to 55 days for abuse monitoring.