Security architecture & data handling
Platform architecture
| Layer | Component | Role |
|---|---|---|
| Identity | SSO / Active Directory | Every user authenticates against your identity provider before reaching the application — see Identity & access. |
| Front end | Vercel (React/Next.js) | Static and serverless UI hosting, global distribution, edge caching. |
| Back end | Supabase (Next.js API layer) | Application server, real-time layer, authentication, storage, and instant API. |
| Database | PostgreSQL (via Supabase) | Primary data store for use cases, solutions, and platform data. |
| Notifications | Resend | Outbound transactional/notification email. |
| Error monitoring | Sentry | Application error and exception tracking. |
| Compliance monitoring | Vanta | Automated security-control monitoring and SOC 2 evidence collection — this is the tooling behind AlignAI’s continuous compliance posture referenced in SOC 2 & certifications. |
| Product analytics | PostHog | User behavior and performance analytics. |
| AI / LLM | Azure OpenAI | Hosts the primary LLM used by the platform today. |
| AI / LLM (evaluation) | Anthropic Claude | Being evaluated for additional use cases; not yet a primary processing path. |
Where use case and use-case content data actually goes
For a security reviewer, the practical question is usually “what touches our data” rather than the full stack. Based on the architecture above:
- Application data (use cases, solutions, custom fields, comments, audit history) is stored in PostgreSQL, managed by Supabase. Supabase also handles authentication and storage for the platform.
- AI-generated content (summaries, risk scoring, the MCP prompt templates in MCP server) is processed through Azure OpenAI.
- Notification content (email bodies, which may reference use case names or statuses) passes through Resend.
- Error monitoring (Sentry) and product analytics (PostHog) capture application telemetry (stack traces, usage events) as part of normal operation.
Encryption
AlignAI’s Cryptography Policy requires that cryptographic risk be formally assessed for data in processing and at rest, and that strong cryptography — implemented in line with industry standards including NIST SP 800-57 — be applied wherever encryption is used, with documented key-management procedures. Customer and confidential data in storage or transit over a public network must use current, vendor-recommended cipher configurations.
Encryption at rest for AlignAI’s Supabase-hosted data stores has been independently verified as part of AlignAI’s SOC 2 Type II examination, alongside TLS in transit.
Tenancy model and hosting region
AlignAI runs on AWS, hosted in the US East region. This is the underlying cloud infrastructure beneath the Supabase (backend/database) and Vercel (frontend) platforms shown in the architecture diagram above — both of those managed platforms run on AWS themselves.
Backup, retention, and disaster recovery
AlignAI maintains a documented Business Continuity and Disaster Recovery (BC/DR) plan covering business-critical IT systems, tested annually through a tabletop exercise. This control has been independently audited under AlignAI’s SOC 2 Type II examination with no exceptions noted. Encryption at rest for the Supabase-hosted data stores has likewise been independently verified as part of that same examination. Backups are monitored for completion, with any failures investigated and rerun. Continuity of the production service relies on AWS’s own availability commitments and SLAs, consistent with the platform’s AWS-hosted infrastructure.
Subprocessors
AlignAI’s primary subprocessors for the platform:
| Subprocessor | Role |
|---|---|
| Supabase | Backend, database (PostgreSQL), authentication, and file storage |
| Vercel | Frontend hosting and content delivery |
Both run on AWS infrastructure (see Tenancy model and hosting region above). A full subprocessor list is available at AlignAI’s Trust Center (see Vendor portal).