Security

Point11 is committed to protecting the security and privacy of our customers’ data. This page describes how we isolate, protect, and monitor that data, and where we stand on compliance.

Customer Data Isolation

• Each customer’s data is kept separate inside the database itself. Postgres row-level security is enabled and enforced on every table that holds customer data, and the application connects through a database role that cannot bypass it.
• A request that does not identify its customer workspace is refused by the database rather than answered.
• Automated tests verify these isolation rules.

Infrastructure

The Point11 platform is hosted on Vercel, with managed Postgres (Neon) and Redis (Upstash). When a customer configures its own credentials, AI model calls can run in that customer's Amazon Bedrock, Microsoft Azure, or Google Vertex AI account.

• Data encrypted in transit using TLS 1.2 or higher for all connections
• HTTPS enforced by browsers through HTTP Strict Transport Security
• Database connections require TLS with full certificate verification
• Data encrypted at rest using AES-256 or equivalent
• Model provider credentials that customers supply are additionally encrypted by Point11 with AES-256-GCM and bound to the customer’s workspace
• Platform-level DDoS mitigation at the network edge

Access Control

• Sign-in and single sign-on handled by our identity provider, WorkOS, with optional two-step verification by passkey, authenticator app or text message, which an organization can require, and single-use recovery codes stored only as hashes
• Role-based access controls with least-privilege principles
• API keys shown once, stored only as a hash, scoped to a single workspace, and set to expire within a year
• Access to production systems limited to authorized personnel
• Point11 staff access granted only to company accounts, with every grant, change, and removal recorded in an audit log
• Support access to a customer workspace requires a recorded reason, is time-limited, and is logged when it starts and ends; each customer can choose to be notified each time or to approve it first

Monitoring and Logging

• Security-relevant actions, including sign-ins, two-step verification changes, role changes, API key changes, and staff access, recorded in an append-only audit log that the database protects from edits and deletions, kept for at least one year
• Automated health checks, including synthetic tests of critical customer paths every five minutes
• Operational incidents tracked from detection to a documented resolution

Secure Development

• Every production release passes automated checks, including type checking, linting, unit and integration tests, and database schema verification
• Database changes reviewed before release, with applied migration history that cannot be altered
• Automated alerts for known vulnerabilities in our software dependencies
• Automated secret scanning on commits and pushes to our code repository
• New versions of third-party packages wait three days before they can be installed, limiting exposure to compromised releases
• Server-side safeguards that stop the platform from fetching private or internal network addresses

Data Handling

Point11 does not train its own AI models on customer data. Meta may use the inputs and outputs of the Muse Spark models that run many Point11 Analytics features to improve its models under Meta's terms; our Privacy Policy lists the features and data involved. For other language and image model calls through Vercel AI Gateway, we ask the Gateway to use only providers that do not train on the data sent.

Customer data is retained while needed to provide the services and meet legal obligations. Our Privacy Policy describes what is deleted when an account closes and what is kept. Customers may request deletion in writing.

The service providers that process customer data, and what each one receives, are listed in our Privacy Policy.

Point11 does not directly process or store payment card data; payment processing is handled by PCI DSS-certified processors (Stripe). To discuss HIPAA requirements or other compliance needs, contact legal@point11.ai.

Incident Response and Recovery

• Confirmed security incidents affecting customer data are reported by email to the affected workspace’s owners and admins without undue delay, and within 72 hours of our becoming aware of them
• Post-incident review and remediation for confirmed incidents
• Managed database backup and point-in-time recovery through our database provider, Neon

Compliance

Point11 does not yet hold a SOC 2 report or an ISO 27001 certification. Our hosting and database providers, Vercel and Neon, maintain SOC 2 Type 2 reports for the infrastructure Point11 runs on; those reports do not cover Point11’s own application.

Reporting Security Issues

To report a suspected security incident affecting your Point11 account or data, such as unexpected activity, an exposed API key, or suspected unauthorized access, email security@point11.ai. Report a security vulnerability in Point11’s platform to the same address; scope, safe harbor, and reporting guidance are in our vulnerability disclosure policy.

Security Reviews

Evaluating Point11 as a vendor? We complete security questionnaires and can walk your team through these practices in more detail. Contact legal@point11.ai or your account representative.

Prefer to buy through your cloud provider? Point11 Analytics is available on AWS Marketplace and Microsoft Marketplace.