What we do with your evidence.
You are about to hand a compliance vendor your access reviews, your incident records and your infrastructure configuration. Here is where that goes, where the AI runs, and who can reach it.
Everything on this page is checkable. The transport controls can be confirmed with one command against our domain. The subprocessors are the services the product visibly calls. Where something is not in place, it is said here rather than left out.
A security page that lists reassuring adjectives is worth nothing, and you of all readers know it, because you are here to buy help proving the opposite about your own company. So this page holds itself to the standard our report verification guide asks you to hold vendors to. If a statement below cannot be checked from outside or read in our code, it is not here.
Transport and browser security
Run curl -I https://www.polaralabs.com/ and read the response headers yourself. You should see all five of these.
- HTTPS everywhere, with HSTS
- strict-transport-security is set to one year and includes subdomains, so a browser refuses to talk to us over plain HTTP after the first visit.
- A content security policy
- Scripts, styles, images, fonts and network destinations are restricted to a named list. frame-ancestors is none, so no other site can frame the app.
- Clickjacking and sniffing defenses
- x-frame-options is DENY and x-content-type-options is nosniff.
- A restrictive permissions policy
- Camera, microphone, geolocation, payment, USB and the motion sensors are all disabled for the origin.
- Referrer trimming
- referrer-policy is strict-origin-when-cross-origin, so we do not leak paths to third parties.
Who processes your data
These are the third parties involved in running the product, in two groups. The first stores or processes your account, answers and evidence. The second sees visits to the site or clicks on our ads and never receives your evidence. Together they are the complete list, if you need one for a vendor questionnaire. Google sign-in and the tools you connect are your own accounts, not our subprocessors.
Customer data
| Subprocessor | What it does |
|---|---|
| Netlify | Hosting, CDN, and the serverless functions the app runs on. |
| Supabase | Primary database, authentication, and file storage. |
| Amazon Web Services | S3 for evidence and generated documents, SES for transactional email, and Bedrock for AI drafting, all inside our own AWS account. |
| Stripe | Payments. Card details go to Stripe directly and never touch our servers. |
| Sentry | Application error monitoring. |
Website, analytics and ads
| Service | What it receives |
|---|---|
| PostHog | Product analytics. In your browser only after you allow it in the cookie prompt: pages visited, named button clicks and session recordings with everything typed hidden. From our servers: account events such as signup or payment, as IDs and event names, never answers or files. |
| LinkedIn Insight Tag | Advertising measurement on public marketing pages, only after you allow it in the same prompt. Receives the page address, referrer, browser and device details, IP address and cookie identifiers. |
| Google Ads | No Google tag runs on the site. Once a day Google Ads fetches a file from us listing the ad click ID, whether the click led to a signup or a purchase, its time and, for a purchase, its amount. No name, email, company or answer. |
| Google Fonts | Serves the site typefaces from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address and browser details with that request. |
This list covers the consumer product. If you are a CPA firm running engagements on the auditor platform, the list you want is security and data handling for audit firms, which covers a different data set under different obligations and is shorter than this one.
Where the AI runs
AI drafting runs on Anthropic Claude models hosted on Amazon Bedrock inside our own AWS account, in the United States. Our commercial agreement with AWS forbids using your data to train any model, and Bedrock does not store prompts or outputs. Readiness scoring and gap finding never use AI; the same answers always give the same result. Your answers are sent to the model only when a policy or a gap guide is being written for you, and a file only when it is being checked. Your evidence files and generated documents are stored in our own AWS account. No other AI provider receives your data.
How your evidence is reached
Evidence files live in object storage and are never served from a public URL. When the app or your assigned auditor needs one, the server mints a signed link that expires in fifteen minutes. There is no permanent address for one of your files.
The browser never talks to the database directly on the consumer product. Every read and write goes through a server function that checks who you are first, which means a tampered client cannot reach another company’s row by asking nicely.
Passwords are stored as bcrypt hashes. Accounts created through Google sign-in have no password at all.
Who at Polara can see your data
Support and operations staff can access customer records through an admin surface, because somebody has to be able to fix a stuck engagement. Those sessions are attributed: an action taken on your behalf is recorded as having been taken on your behalf, not as though you did it.
Your assigned auditor sees your engagement. The independent partner auditor is a separate firm with its own obligations, and the report they issue is theirs to give or withhold. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
Our own compliance
Polara Labs is SOC 2 compliant.
If your process also requires a signed questionnaire, a penetration test report or a data processing agreement on your paper, ask us directly. We answer with what exists, and if the answer is no, it is a no rather than a maybe that wastes your quarter.
Reporting something
If you find a security problem in our product, email help@polaralabs.com and it reaches a person the same day. We do not run a bug bounty and will not pretend otherwise, but a real report gets a real answer.
For how any of this would be tested in an examination, our evidence checklist lists what an auditor asks for, and the vendor questionnaire is the one we would expect you to send us.