Security · trust

How we handle your data.

Saen Labs handles regulated documents — passports, financial records, medical evidence — for verticals where one mistake has a measurable cost. This page is a plain-English summary of how we secure that data. For a full vendor-assessment package, email hello@saenlabs.com.

  1. 01

    Data handling

    Customer documents (passports, application forms, supporting evidence) are processed in-region in the cloud you specify (Canada, US, or EU). We do not use customer data to train any model — not ours, not a third party’s. Documents are retained only for the active workflow and the duration explicitly authorized by the customer.

  2. 02

    Encryption

    All data in transit uses TLS 1.3+. Data at rest is encrypted with AES-256. Database keys are managed via the cloud provider’s key management service (KMS).

  3. 03

    Access controls & isolation

    Multi-tenant isolation is enforced at the database level via PostgreSQL Row-Level Security (RLS) policies — every query is scoped to the authenticated organization. RBAC roles (org_admin, org_agent, org_applicant, b2c_user) gate every API route. The platform was built with these primitives from day one, not retrofitted.

  4. 04

    Audit & accountability

    Every status change on every record (applications, profiles, documents, templates) is logged to an append-only status_history table. Organizations can never be deleted — only suspended — to preserve audit lineage for regulatory inquiries.

  5. 05

    Sub-processors

    We use a small, deliberate set of sub-processors: Supabase (Postgres + auth + storage), Vercel (hosting), Azure Document Intelligence & AWS Textract (OCR), DeepSeek & Gemini (LLM inference). All sub-processors are reviewed for SOC 2 / ISO 27001 compliance before integration. Full list on request.

  6. 06

    Compliance roadmap

    SOC 2 Type II — audit in progress, targeting completion in Q3 2026. PIPEDA-aligned for Canadian PII handling. HIPAA roadmap available for the healthcare vertical on request. GDPR-aligned data subject rights (access, deletion, portability) supported across all customer accounts.

  7. 07

    Incident response

    Documented incident response playbook with RTO < 4 hours. Customer notification within 72 hours of confirmed breach, per GDPR Article 33 standards. Severity classification, escalation chain, and post-mortem template all documented internally.

Last reviewed: April 2026. Have a specific compliance question or vendor assessment requirement? hello@saenlabs.com — we’ll respond within one business day.