Security

Last reviewed: June 12, 2026

Ratify is compliance infrastructure for beverage-alcohol producers, so we treat the security of your data as core to the product. This page describes how the platform is built and operated today. We describe only what is actually in place. Where a control is planned but not yet attested, we say so.

Hosting and infrastructure

The Ratify web application runs on Vercel; application data is stored in Postgres managed by Supabase. Both are hosted in the United States. We do not run our own data centers. When you connect a commerce platform (for example Commerce7), we receive order metadata only. We never receive your customers’ credit-card numbers.

Data protection

• In transit: all traffic to the application and its APIs is served over HTTPS/TLS.
• At rest: the managed Postgres database encrypts stored data at rest.
• Secrets: credentials and API keys are held in server-side environment configuration, never in client code or the repository.

Authentication and access control

• Authentication is handled by Supabase Auth. Passwords are hashed by the auth provider; Ratify never stores plaintext passwords.
• Each customer’s data is scoped to their tenant, and access is re-validated server-side on every request. A client cannot read or write another tenant’s data.
• Account holders can reset their password at any time from the sign-in page.

AI and your data

Ratify’s AI features run on Anthropic’s models. Anthropic is contractually bound not to train on our API traffic, so your prompts and the compliance answers you receive are not used to train third-party models. We retain usage data to improve accuracy and maintain audit logs, as described in our Privacy Policy.

Subprocessors

We use a small set of vetted subprocessors, each handling a specific function:

• Supabase: database, authentication, storage (USA)
• Anthropic: LLM inference (USA)
• Sentry: error monitoring (USA, configured with strict PII scrubbing)
• Plausible Analytics: privacy-safe, cookieless page analytics (EU)
• Resend: transactional email (USA)

The authoritative list is maintained in our Privacy Policy.

Monitoring and retention

Server-side application errors (our API and backend services) are monitored through Sentry with strict scrubbing of personal data. Client-side error monitoring on the web and embed surfaces is not yet enabled. Audit logs are retained for 7 years to meet beverage-alcohol industry retention expectations; other account data is retained for the life of your account plus 30 days.

Compliance posture

SOC 2 Type II: planned, not yet attested. We are building toward a SOC 2 examination but have not completed one, and we do not claim certifications we do not hold. If a current attestation is a requirement for your evaluation, contact us and we will share where we are in the process.

Your data rights

You can request a copy of your data or its deletion at any time. See Data Access and Deletion in the Privacy Policy. Signed-in account owners can also export their own account data directly from the product.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email security@getratify.ai. We will acknowledge your report and work with you on a resolution. Please give us a reasonable opportunity to address the issue before any public disclosure. Our machine-readable contact is published at /.well-known/security.txt.