Security Overview

1. What we do not claim

Peakify does not currently hold a SOC 2 report, an ISO/IEC 27001 certification, or any equivalent third-party security certification. We are a small team, and formal certification is something we may pursue as we grow, not something we have completed. If a certification matters to your procurement process, tell us; we would rather say “not yet” clearly than imply something we cannot show you.

2. Encryption

• In transit. Traffic between your browser, your customers’ messaging channels and our servers is encrypted with TLS.
• At rest. Our primary database and file storage run on Supabase, which encrypts data at rest. Backups inherit the same encryption. Conversation attachments and uploaded documents are held in private object storage and served only through short-lived signed links.
• Card data. We never see or store full card numbers. Payment is handled by Stripe; Peakify holds a payment-method token and the card’s last four digits and brand.

3. Keeping each customer's data separate

Peakify serves many customers from one shared system, and keeping each customer’s data apart from every other customer’s is our most important control. Every database table that holds customer or end-user data is protected by database-enforced row-level security: a request can only read or write rows that belong to the organization it is signed in to. New tables get these rules when they are created, and the rules are checked by automated tests before every release.

4. Secrets and credentials

API keys, webhook signing keys and other secrets are kept in a managed secret store and are never committed to source code. Access to production systems requires multi-factor authentication and is granted on a least-privilege basis.

5. Monitoring and error tracking

We use Sentry to catch application errors so problems are found and fixed quickly. Error reports are filtered to avoid capturing message content where practical, and access to them is restricted to Peakify personnel.

6. Abuse and rate limiting

Sign-in, signup, public forms and AI endpoints are rate-limited (backed by Upstash) and public forms are protected by a bot challenge (Cloudflare Turnstile). This limits credential stuffing, automated signup abuse and traffic floods against the parts of the Service most attractive to attackers.

7. Uploaded files

Files that customers or their contacts upload are stored privately and served only through short-lived signed links. We do not currently scan uploaded files for viruses. The inbox marks such files “Not scanned” so the person opening one can decide whether they trust the sender, and a file that ever failed a check stays blocked.

8. Backups and recovery

Production databases are backed up on a regular schedule with a defined retention window, and restores are exercised against a non-production environment so a backup is more than a theoretical safety net.

9. Access control and accountability

• Every account with access to production systems requires multi-factor authentication.
• People and service accounts get the narrowest permissions needed for their job.
• Security-relevant events, such as sign-ins, failed sign-ins, role changes and access to sensitive data, are logged.
• Code changes go through review and automated checks before deployment, and database changes ship as reviewed, version-controlled migrations.

10. The vendors we rely on

We do not build everything in-house. The full list of providers that process customer data for us, with what each one does and where it processes data, is published on our Sub-Processor List, together with the notice we give before that list changes.

11. Incident response

We keep a written incident-response process covering detection, containment, investigation and notification. If a security incident affects your data, we will notify you without undue delay, as set out in our Data Processing Addendum and required by Canadian privacy law.

12. Reporting a vulnerability

If you believe you have found a security vulnerability in the Service, please tell us before disclosing it publicly, at support@peakifyhub.com. We will acknowledge good-faith reports promptly. We will not pursue legal action against a researcher who reports responsibly, avoids accessing more data than needed to demonstrate the issue, and gives us a reasonable chance to fix it before going public.

13. Questions

For security questionnaires, vendor-risk reviews, or any question about how we protect your data, write to support@peakifyhub.com.