For security reviewers

Security & data practices

Version 1.0 · last updated 2026-08-13

AI Law Tracker is a small, independently operated service. We hold no SOC 2, ISO 27001 or third-party penetration-test report, and this page does not imply otherwise. What we can tell you is exactly which controls are in place, how each one works, and where the gaps are — so your security reviewer can make a decision on facts rather than on adjectives.

Security questionnaire (54 answers)Download as text

1. What the system actually is

AI Law Tracker is a Next.js application hosted on Vercel, with a managed PostgreSQL database on Supabase. The public website, the /v1 API, the MCP connector and the embedded widget are all served by the same application; there is no separate customer-facing infrastructure and no software installed on your systems.

Scheduled work — source scraping, freshness checks, backups, monitoring — runs as 33 scheduled jobs on the hosting platform rather than on machines we maintain.

One exception, disclosed because it is the only part of the estate we patch ourselves: a single small Linux virtual machine (DigitalOcean, New York) runs an internal operations daemon. It holds no customer data and serves no public traffic; it reaches our own API the same way any client would. Everything else is provider-managed.

2. Encryption in transit and at rest

All traffic is served over TLS. HTTP Strict Transport Security is set with a two-year max-age, includeSubDomains and preload, so a browser that has seen the site once will refuse to talk to it over plaintext afterwards.

Responses also carry X-Frame-Options: DENY and X-Content-Type-Options: nosniff, which stop the site being framed for clickjacking and stop a browser guessing a content type it was not given.

Data at rest is encrypted by our infrastructure providers (Vercel and Supabase) using their platform-managed encryption. We do not operate our own key management system, and we do not claim to — customer-managed encryption keys are not something we offer.

3. Who and what can reach the database

The load-bearing control is architectural rather than configural: the application never ships a database key to the browser. There is no publishable/anon key in any client bundle, so a site visitor has no path to the database at all — every read and write goes through server-side code holding a service-role credential that is never exposed to a client.

Row-level security is additionally enabled on every table in the database's public schema, as defence in depth behind that boundary.

Administrative and scheduled endpoints are protected by shared secrets supplied through the hosting provider's encrypted environment store. Secret comparison is constant-time, so a wrong token cannot be narrowed down by measuring how long the rejection took.

Secrets are held in that encrypted environment store and are not committed to source control. Access to production systems is limited to the operator and protected by multi-factor authentication on the underlying provider accounts.

4. What personal data we hold, and in what form

The service is a legal-information product. The overwhelming majority of what we store is public law: statutes, bills, regulations, citations and their sources. Personal data is incidental to running the service rather than the point of it.

Where we do hold identifiers, they are stored as irreversible keyed hashes (HMAC-SHA256 with a server-held secret) rather than in plaintext. This covers IP addresses, the email addresses used for abuse-prevention on comments and votes, and API keys — an API key is verified by hashing the presented value and comparing, so the plaintext key exists only in the moment it is issued and is never stored or returned afterwards.

We ask customers not to send special-category data through the service. It is not designed to hold it, and nothing in our processing terms assumes it.

Retention, deletion and return are governed by our Data Processing Agreement: deletion within 30 days of termination, with backup copies ageing out on their normal rotation within 90 days.

5. Data integrity — the control that matters most for this product

For a legal-data service the realistic failure is not an intruder; it is confidently serving something that is wrong or stale. We treat that as a security property and instrument it accordingly.

Every record carries its primary source and the timestamp at which that source was last successfully read, and both are exposed to you rather than kept internal. A source that stops responding is recorded as a fault against that source, so a jurisdiction that has quietly frozen shows up as a fault instead of as an unchanging page.

Automated checks run continuously against invariants — freshness, row counts, and whether a job that reported success actually wrote anything. The specific failure they exist to catch is a scheduled job logging "ok" while writing zero rows, which is otherwise invisible.

A verification gate runs in CI and blocks changes that carry unfinished-work or fabrication markers. Legal figures such as penalty amounts and effective dates are held to a sourced-or-absent rule: where we cannot evidence a date, the record says so rather than showing a plausible one.

6. Backups and availability

A full database backup runs weekly (Sundays, 03:00 UTC). A separate daily check at 04:00 UTC compares row counts against the previous day and raises an alert on an unexpected drop — a backup you have never tested against a deletion is a file, not a recovery plan.

The hosting and database platforms provide their own redundancy and their own status pages. We do not operate a hot standby, and we do not offer a contractual uptime SLA. If uptime commitments are a requirement for you, say so before you buy rather than after.

7. Monitoring and incident response

Application and job failures raise alerts to the operator through an always-on channel, and the alert path itself is monitored — a monitoring system that fails silently is indistinguishable from one reporting good news.

For personal data breaches our processing terms commit us to notifying affected customers without undue delay and within 48 hours of becoming aware, with a partial account sent immediately rather than a complete one sent late.

To report a vulnerability, email support@ai-law-tracker.com. We will acknowledge within three business days. We do not operate a paid bug-bounty programme and will not pretend otherwise, but we will not threaten anyone who reports something in good faith.

8. Sub-processors

The full list, with each provider's purpose and processing region, is maintained in our Data Processing Agreement so there is one list rather than two that can disagree. Customers receive at least 30 days' notice before a sub-processor is added or replaced.

9. What we do not have

Stated plainly, because the alternative is that you find out later and reasonably wonder what else was shaded.

SOC 2 (Type I or II)We hold none. We are not going to publish a target date either: a date we cannot keep is worth less than an honest no. If your procurement process has a hard SOC 2 gate, we will not clear it today — better you know now.

ISO 27001 or equivalent certificationNone held, none in progress.

Third-party penetration testWe have not commissioned one, so there is no report to share. What we can share is the concrete control detail on this page and a completed security questionnaire.

Separation of dutiesThe service is run by one operator, so the person who writes a change is the person who deploys it. Automated gates in CI are a partial compensating control; they are not the same thing as a second pair of human eyes, and we do not present them as such.

24/7 on-call rotationAlerts reach the operator at any hour, but there is no staffed rotation and no guaranteed response window outside business hours.

Customer-managed encryption keys, SSO/SAML, audit-log exportNot offered today. They are reasonable enterprise requirements and we would rather record them as gaps than let a demo imply they exist.

Reporting a vulnerabilityEmail support@ai-law-tracker.com with “security” in the subject. We acknowledge within three business days. We do not run a paid bounty programme, and we will not threaten anyone who reports something in good faith.