How we protect your data

Document uploads and the File Vault

Documents you upload are stored in a private storage bucket. The bucket is not public, so files cannot be browsed or downloaded by anyone without an active signed-in session.

Access is enforced at the database layer by row-level security rules. Each file is stored in a folder scoped to your user account, and the authenticated owner or a designated admin can view it. Other signed-in users cannot access your uploads.

When you share a file by WhatsApp or email, the platform creates a temporary signed link. That link expires automatically after seven days and can be regenerated from the File Vault at any time.

Retention and deletion

When a file is deleted from the File Vault, the metadata row is marked as deleted and the underlying file is held for 30 days. After that grace period, a nightly cleanup job permanently removes both the storage object and the metadata row. This gives you a 30-day window to recover a file deleted by mistake.

Files that are not tracked in the File Vault, such as images embedded directly in articles, are removed from storage immediately when deleted.

Authentication and access control

Editor and admin areas are protected by authentication. Admin-only actions, including viewing the full File Vault or deleting files, are checked server-side for the admin role in addition to the route-level sign-in gate.

We do not rely on client-side flags or local storage to decide whether someone is an admin. Every sensitive request is re-validated on the server.

Scheduled jobs and public endpoints

Automation endpoints that run on a schedule (publishing, newsletter sends, intelligence refreshes, outreach dispatch) are protected by a dedicated cron secret and by signed service-role tokens. The public browser key is not accepted for these endpoints, so a visitor cannot trigger background jobs by guessing a URL.

Webhook callbacks from external providers are verified with a shared signature before any data is accepted. Import endpoints require a separate API key. All unauthenticated public endpoints are rate-limited per IP, and failed authentication attempts are logged for admin review.

Confidential records and Privacy Mode

Records in the internal workspace can be marked confidential. A confidential organisation, opportunity or meeting is excluded from the assistant's context by default, so its details are not sent to the AI model unless the operator explicitly asks for it in that request. Every time a record is marked or unmarked confidential, the action is written to an access log that only admins can read.

Privacy Mode is an on-screen control for the internal workspace. When it is on, contact names, client and project names, and conversation titles are replaced with initials and neutral labels, so the workspace can be shown on a shared screen or in a meeting without exposing counterparties. Individual items can be revealed one at a time by clicking them.

AI processing

Assistant features run through hosted models reached over encrypted connections. Prompt content is sent to the model provider only to generate the response for that request. Uploaded documents and CRM records are not used to train third-party models, and content marked confidential is withheld from prompts as described above.

Transport and hosting

All traffic to the site and to the backend is served over HTTPS with TLS. The platform runs on managed cloud backend infrastructure hosted in Southeast Asia. Data is encrypted at rest and backups are encrypted. We do not run third-party advertising trackers on the site.

Responses from the application include security headers that restrict framing, MIME sniffing and content injection. We also enforce HTTPS on published domains.

What we do not claim

This page describes the controls that are visible in the application and its backend configuration. It is not an independent security certification, audit report or legal warranty. We do not claim SOC 2, ISO, GDPR, HIPAA, PCI or equivalent compliance unless we have separately completed and published that process.

Reporting a concern

If you have a security question or believe you have found a vulnerability, email privacy@aseanrising.com. We review reports promptly and will respond to verified requests within 30 days.