Trust Center
Last updated — July 11, 2026
Your customers' conversations run through Asks, so you deserve more than a badge wall. This page lays out our compliance posture, the security controls actually running in production, and every document behind them — stated plainly, claimed only where we have the evidence.
Claimed only where we have the evidence
Some frameworks are legal obligations you demonstrate with published evidence; others are attestations only an independent auditor can grant. We keep the two apart — and tell you which is which.
Asks acts as a processor for your workspace data. Our Data Processing Addendum — with EU Standard Contractual Clauses, the UK IDTA, and the Swiss FADP addendum — is automatically part of every agreement. The public subprocessor register carries a 10-day advance-notice window with a right to object, and deletion and export tooling are built into the product. GDPR has no official certification; what exists is evidence, and ours is published.
Our DPA includes California service-provider terms: we process personal information only to provide the service, and we never sell or share it. Deletion and access requests are honored within the statutory windows, whether they arrive directly or relayed by you.
Payments are processed end to end by Stripe, a PCI DSS Level 1 service provider. Card numbers are entered in Stripe-hosted fields and never touch Asks servers, which keeps the platform in the narrowest self-assessment scope (SAQ-A).
SOC 2 is an attestation only an independent CPA firm can issue after observing controls over months — so, unlike some vendors, we won't show the badge before the report exists. Our controls are designed around the AICPA Trust Services Criteria today (see below), and a formal Type II engagement is planned as we grow. Security questionnaires are answered directly in the meantime.
What's actually running in production
Every line below maps to a control verified in our codebase or infrastructure configuration — the same inventory we use to answer vendor security reviews.
Infrastructure security
- TLS 1.2+ on every public endpoint, with HSTS
- AES-256 encryption at rest on all datastores (database, file storage, vector indexes)
- US-only data residency for customer and end-user content
- Managed-platform topology only — no self-operated hosts to patch or harden
- Daily database backups with point-in-time recovery
- Public status page with upstream-dependency monitoring
- Boot-time validation refuses weak or missing production secrets
Product security
- Application-layer AES-256-GCM encryption for channel credentials, integration secrets, webhook signing secrets, and 2FA secrets
- Passwords hashed with bcrypt; API keys stored only as SHA-256 hashes
- Two-factor authentication (TOTP) with hashed recovery codes
- SAML SSO with domain verification, JIT provisioning, enforced-SSO mode, and an SSO audit log
- Role-based access control (owner / admin / member) enforced server-side on every request
- Tenant isolation enforced per query, plus a dedicated vector namespace per workspace
- Tiered per-IP and per-account rate limiting on all authentication endpoints
- Signature verification with constant-time comparison on every inbound webhook
- Outbound webhooks signed with HMAC-SHA256
- Three-layer SSRF egress protection with DNS pinning on all outbound fetches
- Default-deny CORS allowlist
Data privacy
- Workspace deletion cascades across database, file storage, search, and vector indexes
- Self-serve full workspace export (JSON) for portability and contract-end return
- Automated platform deletion flows — Shopify redaction webhooks, Instagram and Facebook deletion callbacks
- Data subject requests answered within 30 days via privacy@asks.app
- No AI training on your data — our model providers are contractually barred from it
- No raw visitor IP addresses stored; error telemetry is PII-redacted and session replays masked
- Time-boxed data purged automatically (store browsing events after 30 days)
- Cookie consent with analytics and marketing off by default on the marketing site
Organizational security
- Written information-security policy pack, reviewed at least annually
- MFA required on every production and infrastructure console
- All personnel bound by perpetual confidentiality and IP assignment before access
- Least-privilege, tenant-scoped access with annual access reviews
- Third-party risk management: vetting checklist, DPAs with every subprocessor, and a public register with 10-day change notice
Internal security procedures
- Incident-management policy with severity triage, containment runbooks, and mandatory post-mortems for serious events
- Customer breach notification without undue delay — a contractual commitment in the DPA, not just a promise
- Vulnerability disclosure program with safe harbor (security@asks.app)
- CI secret scanning blocks merges; dependency vulnerabilities remediated on 14/30-day SLAs
- Business continuity and disaster-recovery plan: 4-hour recovery target, 24-hour maximum data loss, annual restore test
- Security events (denied authorization, invalid webhook signatures, blocked egress) logged and alerted in real time
The documents behind it all
Public and self-serve — written to be read, not just agreed to.
Internal policy pack — available on request
Request via security@asks.appOur company-wide governance documents are maintained under version control, reviewed at least annually, and shared with customers and partners under NDA:
- Information Security Policy
- Incident Management Policy
- Data Protection, Retention & Deletion Policy
- Third-Party Risk Management Policy
- Password & Authentication Secrets Policy
- Business Continuity & Disaster Recovery Plan
- Asset Inventory
- Compliance Requirements Register
- Data Protection Impact Assessments
Who touches your data, and where
Every provider is US-hosted for customer content, vetted against our third-party risk checklist, and listed publicly before any data flows. Changes come with at least 10 days' email notice to workspace owners and a right to object. None of our AI providers train on your data.
What security teams ask us
Where is my data stored?
All customer and end-user content is stored and processed exclusively in the United States: managed PostgreSQL on AWS us-east-1, compute in DigitalOcean NYC, file storage in Google Cloud US multi-region, and US-hosted subprocessors throughout. International transfers from the EU/UK/Switzerland are covered by the SCCs, IDTA, and FADP addendum in our DPA.
Is my data used to train AI models?
No. Your conversations, knowledge base, and customer records are never used to train models — ours or anyone else's. Our AI providers process data solely to serve your requests and are contractually barred from training on it.
Do you have a SOC 2 report?
Not yet, and we won't pretend otherwise. A SOC 2 Type II attestation requires an independent CPA firm observing controls over a multi-month window; that engagement is on our roadmap. Our controls are designed around the Trust Services Criteria today, and we answer security questionnaires directly at security@asks.app.
Is Asks HIPAA compliant?
Asks is not intended for protected health information and we do not currently sign Business Associate Agreements. If your use case involves PHI, please don't route it through Asks.
How is my data encrypted?
TLS 1.2+ in transit everywhere. AES-256 at rest on every datastore, plus application-layer AES-256-GCM on top for the most sensitive values: channel access tokens, integration credentials, webhook signing secrets, and two-factor secrets. Passwords are bcrypt-hashed and API keys are stored only as SHA-256 hashes.
What happens when I delete my workspace?
Deletion cascades everywhere your data lives: every conversation, message, customer record, and knowledge-base item in the database; every uploaded file and attachment in object storage; and the workspace's vector-index namespaces. Platform-mandated deletion flows (Shopify redaction, Meta deletion callbacks) run automatically as well.
Can I export my data?
Yes — workspace owners can download a full JSON export (conversations, messages, customers, knowledge base, settings) from Settings → Danger Zone at any time, including at contract end.
How will I hear about incidents?
Availability incidents appear on status.asks.app in real time. If a security incident affects your workspace's personal data, we notify you without undue delay with the facts known, likely consequences, and measures taken — a contractual commitment in our DPA.
How do I report a vulnerability?
Email security@asks.app. We acknowledge reports within two business days and commit to safe harbor for good-faith research — details on the Security page.
Will you complete our security questionnaire or sign a DPA?
The DPAis self-serve — it's automatically part of your agreement, no signature round-trip needed. For vendor questionnaires (including full copies of our internal policy pack under NDA), write to security@asks.app.