Back to Elevay

Security

Last updated: 2026-05-19

Elevay is built for founders who sell to security-conscious buyers. This page documents our technical and organisational measures honestly — including where we currently stand short of full sovereignty and how we close those gaps.

1. Architecture and data residency

  • Application: Next.js 15 on Vercel today; migrating to Clever Cloud (FR) for an EU-sovereign hosting option.
  • Primary database: PostgreSQL on Supabase aws eu-central-1 (Frankfurt). EU-sovereign migration target: Scaleway Managed DB (FR) or Infomaniak (CH).
  • LLM inference: Anthropic Claude pinned to eu.anthropic.com by default. Mistral AI (France) is available as an EU-sovereign router target via LLM_PROVIDER=mistral.
  • Embeddings: OpenAI text-embedding-3-small; Mistral Embed available as an EU-sovereign alternative.
  • Transactional email: Resend today; Brevo (FR) is the EU-sovereign migration target.
  • Observability: Sentry pinned to de.sentry.io (Frankfurt); PostHog EU Cloud.
  • Queues: BullMQ on Redis (self-host on EU/CH infra). Inngest for cron orchestration in the current deployment.

See the Sub-processors page for the full vendor list with CLOUD Act exposure marked openly per line.

2. Encryption

  • In transit: TLS 1.2+ everywhere. HSTS enabled.
  • At rest: database encryption (AES-256) provided by the managed DB. Backups encrypted.
  • Field-level: sensitive integration secrets (Instantly API keys, OAuth refresh tokens roadmap) encrypted with AES-256-GCM via ELEVAY_APP_SECRET.
  • Passwords: bcrypt with cost factor 12 (post FINDING-002 fix), checked against HIBP.

3. Access control and tenant isolation

  • Multi-tenant data model with tenantId on every row. All queries scoped through a request-bound AuthContext.
  • Role-based access control (admin, member, viewer).
  • OAuth via Google (Gmail) and Microsoft (Entra) with minimum-necessary scopes.
  • MFA (TOTP + WebAuthn) on the roadmap for Q3 2026.

4. Application security

  • CSP with nonce-based script-src (in progress — tracked in security-audit-2026-04-15, finding H11).
  • SSRF guards on user-supplied URL fetches.
  • IDOR prevention via tenant-scoped queries on all write paths.
  • Webhook signature verification on Stripe, Resend, EmailEngine, Deepgram.
  • Cron endpoints authenticated by shared secret with constant-time comparison.
  • Prompt-injection mitigation: untrusted user content (emails, meeting notes) is wrapped in tagged sections in LLM prompts.

5. Backups and continuity

  • Database point-in-time recovery (PITR) provided by the managed DB — 7-day window on Supabase, extended on the migration targets.
  • Application code in version control on GitHub with branch protection.
  • Disaster-recovery runbook with target RTO 4h / RPO 1h — tested quarterly.

6. Logging and monitoring

  • Structured application logs (request, tenant, route, latency, outcome).
  • Error reporting via Sentry (EU) with PII scrubbing (sendDefaultPii: false + beforeSend hook).
  • Centralised log retention (12 months) on the migration roadmap.
  • Audit log of privileged actions (role changes, tenant changes, GDPR/nFADP requests).

7. Sub-processors and data transfers

All sub-processors are listed on the Sub-processors page with operator jurisdiction and CLOUD Act exposure. Transfers outside the EEA rely on European Commission Standard Contractual Clauses + supplementary measures (encryption, minimisation, regional endpoint pinning). We do not depend on the EU-US Data Privacy Framework as a primary transfer basis.

8. EU-sovereign profile

Customers required to operate under a strict EU-sovereign profile (e.g. selling to public-sector, regulated finance, or sovereignty- sensitive industries) can opt into the sovereign stack:

  • LLM: Mistral La Plateforme (FR) instead of Anthropic
  • Embeddings: Mistral Embed instead of OpenAI
  • Database: Scaleway Managed DB (FR) or Infomaniak (CH) instead of Supabase
  • Hosting: Clever Cloud (FR) or Infomaniak (CH) instead of Vercel
  • Email: Brevo (FR) instead of Resend
  • Enrichment: Datagma + Pappers (FR) instead of Apollo
  • Observability: GlitchTip self-host + PostHog self-host on EU/CH infra

Contact security@elevay.app to provision an EU-sovereign tenant.

9. Compliance roadmap

  • GDPR + nFADP: in production (data subject rights, RoPA, sub-processor manifest, regional pinning).
  • ISO/IEC 27001:2022: readiness phase — target audit Q2 2027.
  • SOC 2 type II: type I assessment Q4 2026, type II (6-month observation) Q3 2027.
  • SecNumCloud 3.2 (ANSSI): evaluated for the EU-sovereign profile once Clever Cloud / Scaleway Cloud Gouv qualification stabilises.

10. Reporting a vulnerability

Email security@elevay.app with details. We acknowledge within 24 hours and aim to issue a fix within 14 days for critical findings. We do not currently run a paid bug bounty but we credit researchers publicly with their consent.