Skip to main content

Trust & Security

Align is built to be deployed inside engineering organizations that care about how their decision data is handled. This section documents the controls Align implements, our data-handling commitments, and the subprocessors involved.

Compliance status

Align's security controls are implemented and mapped to the SOC 2 Trust Services Criteria. A formal SOC 2 audit is in progress - Align is not yet certified. We share our detailed controls matrix and progress with prospective customers under NDA.

Architecture commitments​

  • Tenant isolation at two layers. Every API request is scoped to a single tenant resolved from the verified auth token (never a client header), and PostgreSQL Row-Level Security is enforced as a database backstop: the application connects as a restricted, non-owner role, so an application bug cannot read another tenant's rows. See RLS Cutover.
  • Encryption everywhere. TLS in transit, encrypted storage at rest (RDS, S3, cache), and OAuth credentials encrypted with AES-256-GCM using a master key you control. The service refuses to start in production without that key rather than storing secrets in plaintext.
  • Key rotation. The OAuth-token master key can be rotated with zero downtime. See Encryption Key Rotation.
  • Source content is processed, not hoarded. Align extracts decisions from source messages and discards the raw text after analysis. See Data Retention.
  • PII redaction before any LLM call. Emails, names, phone numbers, SSNs, IP addresses, and API keys are redacted (Microsoft Presidio, on by default) before text is sent to a language model. You can also point Align at a local LLM for zero cloud egress.

Access control & auditability​

  • SSO via SAML 2.0, OIDC, Google, and Azure AD; SCIM provisioning.
  • Role-based access control with directory-group-to-role mapping.
  • An append-only audit trail of mutations and access-control denials, retrievable by org admins via a filterable audit-log API, with legal-hold support.
  • Per-user data export and deletion endpoints (GDPR Article 15/17/20), with legal hold support.

Reporting a vulnerability​

See SECURITY.md for responsible-disclosure contact and process.