Trust
How SaliencyLab handles access, uploads, AI processing, vendor relationships, and incident response. Written to be concrete about current practice and clear about what is not yet claimed.
Last updated: October 1, 2026
Procurement checklist: scope, evidence and open exceptions
Workspace views sit behind authenticated routes. Media access is handled through short-lived signed URLs (15-minute TTL) rather than public bucket links. Role-based access (owner / admin / editor / viewer) is enforced in the product.
The public service uses HTTPS with TLS encryption in transit. Data at rest is encrypted with AES-256 (Supabase managed Postgres and Storage default). Backups are encrypted with the same standard.
Row-level security (RLS) policies enforce workspace isolation at the database layer. Every privileged operation (for example, pro_override) is recorded in an audit log.
Creative analysis is run on Google Cloud Vertex AI and related Google Cloud services. Per Vertex AI terms, customer inputs are not used to train foundation models. Full sub-processor list at /legal/sub-processors.
Primary database and object storage run in Supabase EU (Paris, France). Select operational sub-processors (Vercel, Stripe, Resend, PostHog, Sentry) are US-based or multi-region. Cross-border transfers are covered by SCCs per our DPA.
Internal code reviews and automated checks are part of our release process. They are not an independent penetration test. No independent penetration-test result is established by this disclosure; ask for a dated, scoped assessment before relying on that assurance.
Email addresses for authentication, uploaded creative assets (images and videos) for analysis, and usage analytics. No payment card data is stored on our infrastructure, all payment processing is handled by Stripe.
Uploaded creatives are processed through Supabase Edge Functions (Deno runtime) and sent to Google Cloud Vertex AI for analysis. Processing happens in real time, and results are stored alongside the original upload in the private workspace.
Primary database and object storage in Supabase EU (Paris, France) with row-level security. Creative assets are stored in private Storage buckets with signed URL access. Managed daily database snapshots are available; point-in-time recovery is disabled. Database snapshots do not include stored creative-file contents.
Creative assets and analysis results are retained while the account is active. Users can delete individual analyses or the entire account at any time. The active-system deletion commitment is 30 days. Backup retention and the outstanding remediation are described below.
Backup status checked on October 8, 2026: managed daily database snapshots are available; point-in-time recovery (PITR) is disabled. Cold exports also exist in a separate private Google Cloud project in Belgium. A downloaded aggregate benchmark export was recovered locally with all 6,396 rows intact. This limited table test does not prove full database, workspace, media or erasure recovery, and the vault is not immutable.
The published 90-day cold-archive retention commitment applies, together with any shorter agreed deletion deadline. Since October 25, 2026 each backup tier is set to that limit, counting the seven days Google Cloud keeps a deleted copy recoverable: Google Cloud cold exports are deleted at 82 days; Supabase cold-backup copies are removed by 90 days at the nightly export, and a scheduled check raises an alert if one is older; and a creative deleted from the product leaves the backup mirror within 90 days. Older copies kept under the earlier, longer settings were released for deletion on October 24 and 25, 2026 and stay recoverable by Google Cloud for seven days after deletion. This operational disclosure does not extend those deadlines or confirm that all residual copies have been erased.
Backups can retain copies after deletion from active systems. They are restricted recovery copies, not a source for serving product features. Before restored data returns to service, operators must reapply erasure requests and verify their effect. That recovery and erasure-replay procedure has not yet been proven in a completed drill.
Google Vertex AI (Gemini 2.5 Flash and Pro) for multimodal creative analysis, Google Cloud Video Intelligence for shot detection, Google Cloud Speech-to-Text for audio transcription. All AI processing runs on Google Cloud infrastructure.
Uploaded images and video frames are sent to Vertex AI with structured prompts. Video audio is sent to Speech-to-Text for transcription. No other customer data is included in model requests.
Google Vertex AI does not use customer data for model training when accessed via the API. SaliencyLab does not train its own models on customer uploads. Outputs are returned per-request and stored only in the customer workspace.
Production systems are monitored via Sentry for error spikes, Supabase observability for database health, and Vercel for runtime issues. Critical alerts page the on-call engineer.
In the event of a personal data breach affecting Customer Content, account owners will be notified by email without undue delay, and in any event within 72 hours of awareness. Full obligations are set out in the DPA.
Security researchers can report vulnerabilities to contact@saliencylab.com. We commit to acknowledging within 3 business days and requesting a 90-day embargo before public disclosure while we investigate and remediate.
These services let you request an external check of the live domain's TLS configuration or HTTP headers. A scanner result covers that check at that time; these links do not establish continuous monitoring, a penetration test or a security certification.
Deep TLS / certificate / cipher-suite analysis. Checks protocol support, key strength, known vulnerabilities (Heartbleed, POODLE, etc.), and certificate chain correctness.
Run a live SSL Labs scan →Mozilla's security-headers scanner. Grades CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags, and subresource integrity.
Run a Mozilla Observatory scan →Scott Helme's scanner. Lightweight headers grade (A+ through F) with specific missing-header callouts.
Run a SecurityHeaders scan →Headers observed on the public Security page (October 1, 2026):
max-age=63072000; includeSubDomains; preload. This is the observed header; preload-list enrollment is a separate check.default-src 'self' with explicit service origins. The current script policy includes 'unsafe-inline' and 'unsafe-eval'; it is not a strict nonce-only policy. frame-ancestors 'none' restricts iframe embedding.strict-origin-when-cross-origin.DENY (clickjacking protection).nosniff.No current scanner grade is claimed here. Share a dated result or concern with contact@saliencylab.com.
SaliencyLab does not hold its own SOC 2 Type II report or ISO/IEC 27001 certification. A provider's assurance report covers that provider's assessed services; it does not certify SaliencyLab's application or operations.
Review each provider's current report, service scope and customer responsibilities for your procurement requirements. These links are not a SaliencyLab certification.
Our Data Processing Addendum (DPA) is published at /dpa and can be countersigned by enterprise customers. It covers controller/processor roles, sub-processor notice, Standard Contractual Clauses for international transfers, 72-hour breach notification, and deletion / return of data on termination.
The current sub-processor list is published at /legal/sub-processors.
Most enterprise reviews come down to four questions: who can access raw files, how media URLs are exposed, what vendors touch the content, and what claims the company is willing to make in a procurement process.
Last updated: October 1, 2026