Review the controls that protect customer documents, the limits on AI-assisted workflows, the providers involved, and the claims we deliberately do not make. Each statement is scoped to the current MatchAudit SaaS implementation unless a linked contract says otherwise.
Application security
These statements describe current design and enforcement points. They are intentionally narrower than a certification, legal conclusion or promise that every risk is eliminated.
Workspace records are scoped to organization membership. PostgreSQL Row Level Security policies provide a database-layer boundary in addition to server-side authorization checks.
Organization-scoped policies and cross-tenant isolation tests
Questionnaires, policies, contracts and evidence are stored in private object storage. Download routes verify workspace access before issuing a short-lived signed URL.
Private buckets, server-authorized access and expiring links
Supported uploads are checked for filename, declared type and file-signature agreement. Document workflows that require malware scanning do not release a file for analysis without a clean verdict.
Bounded parsing, content validation and malware verdict gates
AI may classify a document, extract a cited candidate fact or draft a response. It cannot approve a response, submit it to a third party or make a compliance decision; a user must review consequential output.
Human approval gates and source-linked draft outputs
Current backend AI requests disable provider-side response storage. AI processing is feature-specific and is disclosed as subprocessing; it is not described as a substitute for contractual safeguards.
Backend-only credentials and provider storage disabled in requests
Uploaded evidence is recorded with a SHA-256 hash and bounded metadata. Material workflow actions create audit records where that workflow supports them, preserving who did what and when.
Content hashes, provenance metadata and workflow audit events
Document lifecycle
The path is designed to reduce unnecessary exposure and keep consequential actions with an authorized person. Exact retention depends on the applicable product, account and contract.
Check authorization, size, type and file structure; apply the relevant security scan before analysis.
Keep accepted documents in tenant-scoped private storage with hashes and controlled metadata.
Use only the enabled workflow and configured provider, with backend-only credentials and bounded output schemas.
Present extracted facts and drafts for an authorized person to review before use or sharing.
Human decision boundary: MatchAudit can prepare evidence and a draft. The customer remains responsible for approving a response, deciding a screening outcome and determining the lawful use of uploaded data.
Infrastructure assurance
MatchAudit uses Supabase for core managed authentication, PostgreSQL database, and private evidence-file storage infrastructure. Supabase's hosted platform is SOC 2 Type 2 compliant and ISO/IEC 27001:2022 certified.
Supabase states that its hosted platform is assessed annually against the SOC 2 Trust Services Criteria.
Supabase SOC 2 informationSupabase states that its information security management system is certified to ISO/IEC 27001:2022.
Supabase ISO informationThese credentials apply to Supabase's hosted platform and do not constitute certification of MatchAudit. MatchAudit remains responsible for application authorization, secure configuration, data handling and operational controls.
Supabase security overviewAssurance boundaries
Trust is damaged by an unsupported “yes.” These limits are part of the security answer, not fine print.
Due diligence
These pages are maintained as separate records so security, privacy, legal and screening-methodology questions do not collapse into a single marketing statement.
Personal data
Controller and processor roles, purposes, legal bases, rights and retention disclosures.
Open resourceContract terms
Article 28 terms, security measures, breach notification, audits and international transfers.
Open resourceService providers
Named providers, processing purposes, locations and transfer safeguards.
Open resourceContract
The agreement governing service use, acceptable use and the allocation of decision responsibility.
Open resourceService operations
How operating objectives differ from contractually agreed service commitments.
Open resourceData transparency
Source coverage, provenance, record counts and freshness for screening datasets.
Open resourceMethodology
How candidate matching works, what a score means and where human review remains necessary.
Open resourceInclude the affected feature, observed behavior and a safe way to reproduce it. Do not send live customer data or secrets by email.
info@matchaudit.ioSend the questionnaire and state the product, intended data categories, integration path and required evidence. We will scope each answer rather than reuse a blanket claim.
Contact MatchAudit