Security & Trust
Our Approach
ChangeMap is designed to protect customer information through a combination of technical, administrative, and operational safeguards appropriate for an early-stage SaaS platform.
Infrastructure
ChangeMap is hosted using Vercel and Supabase. Vercel also provides consent-gated Web Analytics across public and authenticated application pages. Supporting providers include Cloudflare, Stripe, Postmark, OpenAI, Featurebase, Google Analytics, and Apollo. Anthropic is authorized as an AI subprocessor but is not currently used for production inference.
Encryption
Data transmitted between users and the Service and between ChangeMap and its providers is protected using TLS/HTTPS. Customer content stored in the primary database and file storage is encrypted at rest through controls provided by Supabase and other applicable infrastructure providers. ChangeMap does not currently provide customer-managed keys or separate application-layer field encryption.
Access Controls
Customer access is isolated at the workspace level using Supabase row-level security, workspace membership checks, private storage controls, and application authorization. All members of a workspace can access the projects within that workspace; ChangeMap does not currently provide project-level sub-tenancy. Customer authentication uses Supabase Auth with email and password, and sessions are validated on protected routes. Customer multi-factor authentication and enterprise SSO are not currently available. Privileged production access is restricted to authorized personnel and system processes required to operate the Service.
AI Processing
ChangeMap currently uses OpenAI for production AI inference and transmits information only as needed to provide requested features. ChangeMap does not use customer content to train ChangeMap general-purpose models and does not permit OpenAI or Anthropic to use customer content to train their general-purpose models. The F10 summary Responses request explicitly disables provider application-state storage; other OpenAI requests may use provider defaults. ChangeMap does not claim Zero Data Retention, and limited provider retention may still apply for abuse monitoring or legal and security purposes. Anthropic is authorized but is not currently used for production inference.
Backups and Recovery
ChangeMap relies on Supabase-managed database backup capabilities and Vercel's deployment infrastructure. Workspace deletion has a seven (7) day cancellation grace period before purge begins; this is not a representation of backup retention or a published recovery-time or recovery-point objective. Backup copies and provider records may persist until ordinary retention and deletion cycles expire and remain subject to access controls and legal obligations.
Monitoring and Logging
ChangeMap uses application logging and monitoring available through its hosting, database, and authentication providers to support reliability, troubleshooting, fraud prevention, and security investigations. These controls do not constitute a continuously staffed 24/7 security operations center.
Stakeholder Analysis
ChangeMap analyzes transformation conditions and organizational evidence and may classify engagement, sentiment, influence, or related attributes for named stakeholders when customers submit that information. The Service is not designed to score employee job performance or make automated employment decisions. Customers remain responsible for human review and for lawful, appropriate use of stakeholder-related outputs.
Incident Response
ChangeMap will investigate confirmed security incidents and notify affected customers without undue delay and in accordance with applicable law.
Compliance Posture
ChangeMap is designed with GDPR, applicable U.S. state privacy laws, and industry security practices in mind. ChangeMap does not currently claim SOC 2, ISO 27001, or other third-party certification.
Security Contact
Security concerns may be reported to security@usechangemap.com.