Participant data,
handled like it matters
Research data is people telling you things in confidence. This page says what we actually do with it — including the parts that are still in progress.
Where we stand today
SOC 2 Type II
In progressWe are working toward SOC 2 Type II. It is not certified today, and we will not imply otherwise. The infrastructure and access practices were built to meet the control set from the start.
GDPR
In placeWe support data subject access, correction and deletion requests, and can execute a Data Processing Agreement on request. Ask and we will send the current version.
CCPA
In placeCalifornia residents can request disclosure of what we hold and have it deleted. The same mechanisms serve both regimes.
Security questionnaires
In placeSend yours over and we will complete it. Expect a number of lines to come back "not yet" — the same ones listed further down this page.
Third-party penetration test
Not yetNo external firm has tested Umwelt. We have not commissioned one, and at our size we would rather tell you that than describe our own testing as though it were independent.
Data residency
Not yetEverything runs in the United States, and you cannot choose a region today. There is no EU-resident deployment; we will add regions as scale justifies them. If your participants are covered by a residency requirement, raise it before you upload anything.
How isolation is enforced
Isolation lives in the database, not the interface
Every table is governed by row-level security policies enforced by Postgres itself. An application bug cannot leak another workspace's studies, because the query never returns them in the first place. The search index carries the owning workspace in its metadata and is filtered on the same boundary, so retrieval cannot reach across it either.
Encryption
Data is encrypted in transit with TLS and at rest by the managed storage and database layers. That covers uploaded files, transcripts, generated evidence and search data alike.
Access & accounts
Sign-in is email and password, and accounts exist only by invitation — there is no public signup. Permissions are scoped per project and per study, so a workspace can hold several clients or several confidentiality levels without them meeting. There is no multi-factor authentication yet, and no SAML SSO or SCIM provisioning. If your policy requires either, we are not ready for you on that point today.
Infrastructure
Umwelt runs on Vercel with Supabase-managed Postgres and storage, and Pinecone for search. We inherit their physical and platform controls rather than running our own — which is the right trade at our size, and also means our security floor is theirs.
Everyone who touches your data
The complete list. If we add a provider that handles research content, we will tell you before it starts.
| Provider | Role | What it handles |
|---|---|---|
| Vercel | Application hosting | Requests in transit. Uploads pass through on their way to storage. |
| Supabase | Postgres, file storage, authentication | Everything at rest — files, transcripts, insights, accounts. |
| Pinecone | Vector search | Text chunks and their embeddings, tagged with the owning workspace. |
| OpenAI | Transcription, embeddings, analysis models | Audio files and transcript text, at the point of processing. |
| Anthropic | Analysis and synthesis models | Transcript text and generated evidence, at the point of processing. |
| Resend | Transactional email | Names and email addresses. No research content. |
| Sentry | Error monitoring | Stack traces and request context. Not a destination for research content. |
Your corpus never becomes training data
Who processes it, precisely
OpenAI and Anthropic — named, because “enterprise AI APIs” is not an answer your security team can file. Neither trains on data sent through their API; that is their standing commercial commitment, not something we negotiated. Both may hold content briefly for abuse monitoring before deleting it. Zero-retention addenda sit behind volume thresholds we have not reached yet, so we do not claim them — we will sign them when we qualify.
We don't train on it either
Your research is not used to train any Umwelt model, is not pooled with other customers' data, and is not used to improve results for anyone but you.
Nothing publishes itself
Generated output enters a review queue and stays visibly proposed until a researcher accepts it. There is no path from model output to published finding that skips a human.
Deletion, retention and getting your data out
Deletion is a two-step
Deleting a study, insight or report moves it to Trash rather than destroying it. Items in Trash are permanently purged after 30 days by a scheduled job. The window exists so that an accidental delete — or an accidental re-run of analysis — is recoverable. If you need something destroyed sooner than the window allows, ask and we will do it.
Export, any time
Reports export as HTML, Markdown, PDF and slide decks from inside the product. For a full corpus export — studies, transcripts, evidence — contact us and we will produce it. Your data is not held hostage by the format.
Backups
Database and file storage are backed up through our managed providers, and database and storage are backed up independently of each other. We are formalising and drilling the restore procedure as part of production hardening; ask for the current state and we will tell you exactly where it stands.
Incidents
If we confirm a breach affecting your data, we will notify you within 72 hours, per GDPR, with what we know at the time rather than waiting for a complete picture.
What we have not done
Umwelt is a small, self-funded product in private beta. These are the controls a company our size does not have yet, collected in one place so you do not have to find them by asking.
- No third-party penetration test.
- No multi-factor authentication on accounts.
- No SAML SSO or SCIM provisioning.
- No immutable audit log of who read what.
- No choice of data region, and no EU-resident deployment.
- Backups run, but the restore has not been drilled end to end.
- Trash purges on a fixed 30-day window; retention is not configurable.
- No published uptime commitment or status page.
If one of these is a hard requirement, Umwelt is not the right tool for you this year, and we would rather you knew now. Several are things we will build; none of them are things we will pretend to have.
Send us your questionnaire
Security questions, a DPA, or a call with whoever has to sign this off — reach us at hello@umweltlabs.com. If you believe you have found a vulnerability, use the same address and we will reply the same day.