Trust
Security
The controls that keep your data, your transactions, and your commissions safe.
Encryption
Supabase encrypts the production database at rest. HTTPS protects connections to our application and API. Provider encryption operates at the infrastructure level.
Row level isolation
Database row level security and server authorization checks restrict customer access by organization and role. Privileged backend operations require separate authorization.
Built on SOC 2 infrastructure
We use infrastructure providers with SOC 2 Type II reports. Their assessments cover their services and do not constitute a SOC 2 report for Adamation AI.
No data sharing
We do not sell customer data. Connected service providers process data to deliver requested features. Organization exports are available to authorized administrators.
Audit logs
The platform records application activity and authentication events. These records are not a complete log of every privileged database access.
Least privilege access
Production administration is limited to authorized staff for customer support, maintenance, and security. Customer roles restrict access within the application.
Compliance posture
- Infrastructure: Our infrastructure providers maintain their own SOC 2 Type II reports. Access to those reports is subject to each provider's terms.
- SOC 2 for Adamation AI: Not yet pursued. Planned once we cross 25 brokerage customers.
- GDPR: We follow EU data protection principles: lawful basis, data minimization, access and deletion rights, and named processors.
- Data residency: Our primary Supabase database is hosted in Oregon, USA. Connected providers have their own processing and residency terms.
- HIPAA: The service is not offered as a HIPAA-compliant system for protected health information.
Google CASA Tier 2 verified. Our Gmail and Google Calendar integration passed an independent Cloud Application Security Assessment in March 2026, performed by TAC Security, a Google authorized assessor. The March 2026 scan reported no findings within its assessment scope.
Operational practices
- Automated daily production database backups.
- Production dependency vulnerability scanning is part of the deployment verification process.
- Two factor authentication is available on every account.
- Incident response: we commit to notifying affected customers within 72 hours of confirming a security incident that touches their data.
Your controls
- Optional two factor authentication is available on every account.
- Role based permissions: broker, team lead, agent, coordinator, viewer.
- Organization data export (CSV + JSON) for broker administrators, no support ticket required.
- Account deletion on request, with confirmation of irreversible data removal.
Report a security issue
If you believe you have found a vulnerability, email security@adamationai.com. We acknowledge within one business day and work with you on responsible disclosure. Coordinated disclosure is welcomed and appreciated.
Questions about how we protect your data?
Book a 30-minute strategy call. We will walk through the security model with your brokerage in mind.
Book a strategy call