Trust
What we do with your evidence.
You are about to hand a compliance vendor your access reviews, your incident records and your infrastructure configuration. Here is where that goes, who can reach it, and what we have not built yet.
Everything on this page is checkable. The transport controls can be confirmed with one command against our domain. The subprocessors are the services the product visibly calls. Where we have not done something, it is in the last section rather than left out.
A security page that lists reassuring adjectives is worth nothing, and you of all readers know it, because you are here to buy help proving the opposite about your own company. So this page holds itself to the standard our report verification guide asks you to hold vendors to. If a statement below cannot be checked from outside or read in our code, it is not here.
Transport and browser security
Run curl -I https://www.polaralabs.com/ and read the response headers yourself. You should see all five of these.
- HTTPS everywhere, with HSTS
- strict-transport-security is set to one year and includes subdomains, so a browser refuses to talk to us over plain HTTP after the first visit.
- A content security policy
- Scripts, styles, images, fonts and network destinations are restricted to a named list. frame-ancestors is none, so no other site can frame the app.
- Clickjacking and sniffing defenses
- x-frame-options is DENY and x-content-type-options is nosniff.
- A restrictive permissions policy
- Camera, microphone, geolocation, payment, USB and the motion sensors are all disabled for the origin.
- Referrer trimming
- referrer-policy is strict-origin-when-cross-origin, so we do not leak paths to third parties.
Who processes your data
These are the third parties involved in running the product. If you need this list in a vendor questionnaire, it is the complete one.
| Subprocessor | What it does |
|---|---|
| Netlify | Hosting, CDN, and the serverless functions the app runs on. |
| Supabase | Primary database, authentication, and file storage. |
| Amazon Web Services | S3 for evidence and generated documents, SES for transactional email, and Bedrock for policy generation. |
| Stripe | Payments. Card details go to Stripe directly and never touch our servers. |
| Sentry | Application error monitoring. |
| PostHog | Product analytics. |
How your evidence is reached
Evidence files live in object storage and are never served from a public URL. When the app or your assigned auditor needs one, the server mints a signed link that expires in fifteen minutes. There is no permanent address for one of your files.
The browser never talks to the database directly on the consumer product. Every read and write goes through a server function that checks who you are first, which means a tampered client cannot reach another company’s row by asking nicely.
Passwords are stored as bcrypt hashes. Accounts created through Google sign-in have no password at all.
Who at Polara can see your data
Support and operations staff can access customer records through an admin surface, because somebody has to be able to fix a stuck engagement. Those sessions are attributed: an action taken on your behalf is recorded as having been taken on your behalf, not as though you did it.
Your assigned auditor sees your engagement. The independent partner auditor is a separate firm with its own obligations, and the report they issue is theirs to give or withhold. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
What we have not done yet
This is the section most vendor security pages leave out, which is exactly why it is worth reading.
We are a small company and this page reflects that. If your procurement process requires a specific certification, a signed questionnaire, a penetration test report or a data processing agreement on your paper, ask us directly rather than assuming from this page. We will tell you plainly what exists and what does not, and if the answer is no, it will be no rather than a maybe that wastes your quarter.
Reporting something
If you find a security problem in our product, email founder@polaralabs.com and it reaches a person the same day. We do not run a bug bounty and will not pretend otherwise, but a real report gets a real answer.
For how any of this would be tested in an examination, our evidence checklist lists what an auditor asks for, and the vendor questionnaire is the one we would expect you to send us.