Security overview
SonicR1 — Security at a glance
A concise, shareable summary for your security review. Need the full questionnaire (CAIQ / SIG Lite) or our DPA? They're available on request.
Last updated June 2026
Hosting regionEU · Frankfurt
EncryptionTLS + AES-256-GCM
Tenant isolationRLS + CI tests
AI processingEU enterprise endpoints
Key storageSeparate vault
Security contactsecurity@sonicr1.com
Data protection
- Where is customer data processed and stored?
- In the EU (Frankfurt). AI requests for EU-region workspaces are processed only in EU regions; non-EU is never used as a silent fallback.
- Is data encrypted in transit and at rest?
- Yes — TLS in transit and at rest. Detected PII values are additionally stored with AES-256-GCM; keys are held in a separate vault from the app credentials.
- Is personal data sent to AI providers?
- Personal data is detected and replaced with tokens before any model call. A central egress guard blocks prompts that lack redaction provenance.
- Are customer calls used to train AI models?
- Conversations are processed on enterprise AI endpoints (not consumer API keys) and aren't used to train publicly shared models. Contractual terms are in the DPA.
Access & isolation
- How is one tenant's data isolated from another's?
- Row-Level Security is workspace-scoped across tenant tables, an authorization guard backstops privileged routes, and cross-tenant isolation tests run in CI.
- How do users authenticate?
- Supabase Auth — email and Google OAuth. SSO is available on Enterprise.
- Can customers delete their data?
- Yes. Capture is consent-gated, audio storage is off by default, retention is configurable, and hard deletion is available per call and per workspace.
Hosting & operations
- Which infrastructure providers are used?
- AWS, Vercel, Supabase and Google Cloud — hosted in the EU (Frankfurt).
- Are the data centers certified?
- The underlying infrastructure is operated on SOC 2 / ISO 27001-certified data centers; those certifications are held by the providers, not by SonicR1.
- What call-recording options exist?
- No call audio is ever recorded. Two modes, chosen per call: an ephemeral live-only mode where nothing is saved (no audio, transcript or notes), and an AI-notes mode where only a transcript and summary are saved — never the audio.
Questions from your security team?
Reach us at security@sonicr1.com — request full questionnaire & dpa.