Security
What we do today, not what we plan.
This page describes the measures in place on 30 October 2026. The binding version is Annex 2 of the Data Processing Agreement.
01
Hosting and data
The application runs on Vercel. The client database and authentication are hosted by Supabase on AWS in Ireland (EU): client data is stored in the EU, encrypted at rest, with row-level security so each client's records are readable only by that client's users and by the service acting for them. Vercel functions and the AI providers run outside the EU, so processing is not EU-only; the Privacy Policy lists every provider with its location.
Backups are encrypted, taken automatically with point-in-time recovery at the provider, and rotated within 30 days.
02
Access
Staff use individual accounts with two-factor authentication; two-factor is required for every admin and team login and available to every client user. Production secrets live only in the hosting provider's encrypted environment store, never in code. Integration tokens (for example Google Analytics) are encrypted with AES-256-GCM under a key held only in that store. Passwords are stored as salted hashes by the authentication provider, never by us.
03
In transit
TLS 1.2 or higher everywhere. Public forms and API routes are rate-limited; the login, signup and contact forms are protected by a Cloudflare bot check where it is enabled. Login attempts are limited per account and per address.
04
AI providers
Prompts go to AI providers under business API terms. Anthropic and OpenAI do not use API inputs to train their models; where a provider's terms are not yet verified, the Privacy Policy says so. We do not permit any provider to train a public model on client data. Generated drafts are checked by an automated verifier against the client's own data before the client sees them, and every draft is marked as AI-generated.
05
Incidents
We notify affected clients within 48 hours of becoming aware of a personal data breach and cooperate with their own notifications to authorities and data subjects. We log security events on every account; clients see their own login history and active sessions on the Security tab of their portal. The full commitment is in the Data Processing Agreement, section 5.
06
Certifications
We do not yet hold a SOC 2 or ISO 27001 report of our own. Our infrastructure providers do; we share their reports under NDA on request, and the DPA sets out how a client can audit us.
07
Reporting a vulnerability
Email security@thenewmap.ai. We acknowledge within 5 business days. We will not take legal action against good-faith research that respects other clients' data, does not degrade the service and does not access more than is needed to show the issue. Please give us a reasonable chance to fix the issue before you publish it. We do not run a bounty programme.
Questions from procurement or a data protection officer: privacy@thenewmap.ai. Related: Privacy Policy, Data Processing Agreement, Terms of Service.
Last updated .