Seven practical commitments
Primary processing is in the EU: the API and compute run in AWS eu-west-1 (Ireland), the primary Neon Postgres database is in eu-central-1 (Frankfurt), and the website and console front-ends run on Vercel in Frankfurt. CloudFront is the public API ingress; Cloudflare handles DNS and the console and marketing edge. Tenant API payloads are not cached at the edge. Documented international transfers, for example Stripe, Anthropic and Resend, are covered by Standard Contractual Clauses.
Postgres + S3 + DynamoDB use the AWS-managed KMS keys by default. SSM SecureString for every secret. No app-level plaintext storage of API keys (SHA-256 hash + 16-char prefix index only).
ACM-managed certs, HSTS preload on all production hostnames, TLS 1.0/1.1 disabled at the edge (CloudFront TLSv1.2_2021). Internal service-to-database traffic runs over private networking with IAM auth, not the public internet.
Console: 8h JWT sessions with passwordless magic-link onboarding (no tenant passwords stored). API: keys sent in the canonical X-Goable-Key header (Authorization: Bearer also accepted), prefix-indexed, SHA-256-hashed, scope-gated. Per-key rate limits + Stripe-metered audit.
LLM features use per-tenant BYOK: the AI explainer, briefing, edge-case and personalised decision-agent surfaces run on the tenant's own Anthropic key. A Goable-provided key is available as a fallback path; when it is used, Anthropic acts as a subprocessor. When a tenant uses BYOK, Goable does not hold that key. Anthropic's API terms exclude API traffic from model training by default. No tenant content is sent to OpenAI, Google, or any other provider. We do not sell or share tenant payloads.
Tenant Anthropic keys are encrypted at the application layer (random IV per encryption, GCM auth-tag tamper check) before they touch the database, on top of the disk-level AWS KMS encryption above. The plaintext is never logged, never returned by any endpoint after the moment you set it, and never appears in an audit payload, only a masked last4. Delete it anytime; see /docs/concepts/llm-byok.
Every scoring call is recorded in scoring_audit_log as a tamper-evident, versioned trail with raw weather samples, the provider chain, and the response that was returned, under documented retention controls. Tenants can export their own audit log on demand. Retention is 1 year by default, extendable under DPA.
What we have, what's in progress
We won't pretend to certifications we don't hold. Below is the honest list. If you're an enterprise prospect with a security questionnaire that asks for the SOC2 Type II report, the answer today is "in progress, see the post-launch plan." If you need the questionnaire answered formally, the partnerships desk is the path.
Designed to support GDPR obligations. Pseudonym-based user-data deletion (right to erasure across personalization, audit, and recommendation stores), tenant-scoped DPA available on signature. Goable periodically assesses whether a DPO is required under GDPR Article 37 based on the nature, scope, and purposes of its processing; until then, privacy@goable.io is the privacy contact point.
Standard form available at /legal/data-processing-agreement (CC BY 4.0 base, signed addendum on request). Sub-processor list is public; new sub-processors are notified 30 days before activation.
Not certified today. We've invested in the controls (audit log, encryption, access management, incident process) rather than the audit logo. An enterprise prospect that needs the report triggers the audit as a real budget line. We will not claim Type I or Type II until paid for and completed.
Not certified today. Most controls are de facto met (the engineering practices map closely) but we won't ship a logo until audited. Same path as SOC2: when a prospect's procurement requires it, we open the engagement.
The engineering reality
Every secret (Stripe, Anthropic, Resend, DB URL, session keys) is an AWS SSM SecureString. IAM roles + scoped ssm:GetParameter on a path prefix. No .envfiles in source control; .envrcfor local dev only and gitignored.
pnpm-lock pinned + Dependabot watching. Critical CVE alerts gate prod deploys. The vendor list is short on purpose: Hono, Drizzle, radix-ui, and lucide are the load-bearing libraries.
AWS Identity Center (SSO) only, TOTP-mandatory. Root account credentials sealed (1Password emergency container). Production access logs go to CloudTrail; ops session activity to scoring_audit_log.
Slack #incidents channel for triage; status updates land on the public status strip promptly on detection. Post-mortems published openly for any incident affecting tenant traffic.
Found something?
Responsible disclosure: email security@goable.io with the details. We acknowledge within one working day, triage within five, and publish a CVE (with credit, unless you prefer otherwise) for anything that warrants one. No bounty programme yet, we're pre-launch, but we'll send merch, name credit, and a real founder reply.
Questionnaires & SIG
If you need a formal security questionnaire (SIG Lite, CAIQ, custom vendor questionnaire), the partnerships desk routes it to the founder + the senior engineer who built whatever piece of the system the question is about. We try to turn it around in five working days.