ThemisIQ Compliance Inc.

Security at ThemisIQ

ThemisIQ processes your most sensitive compliance data: GHG inventories, workforce metrics, supply chain records, and cyber risk registers. We take security seriously, not as a checkbox, but as a foundational design requirement.

TIQ-SEC-001
Policy ID
v2.0
Version
security@themisiq.co
Report issues
Certifications & compliance

Our security posture.

SOC 2 Type I
Target: Q4 2026. Gap assessment in progress
In progress
SOC 2 Type II
Target: Q2 2027. Dependent on Type I completion
In progress
ISO 27001:2022
Target: Q2 2027. Controls mapped, ISMS design phase
In progress
PIPEDA & Law 25 (Québec)
DPA templates complete · privacy breach procedures in place
Compliant
GDPR / UK GDPR: data processor
Standard Contractual Clauses (SCCs) in place · DPA available on request
Compliant
PCI DSS
Payment processing via Stripe (PCI DSS Level 1), and ThemisIQ never stores card data
Via Stripe
Infrastructure

Where your data lives.

Database: Supabase (AWS)
Via Supabase
All customer platform data stored in Supabase on AWS infrastructure. Supabase holds SOC 2 Type II and ISO 27001 certifications. US-East region by default.
Application: Vercel
Via Vercel
ThemisIQ application hosted on Vercel with global CDN. Vercel holds SOC 2 Type II certification. HTTPS enforced on all endpoints; HSTS enabled.
Payments: Stripe
Via Stripe
All payment processing handled by Stripe, PCI DSS Level 1 certified. ThemisIQ never stores, processes, or transmits card numbers.
AI processing: Anthropic
One feature sends data to Anthropic: the Bill Review add-on sends the source documents you upload, so the figures can be read off them. Nothing else in the platform uses AI: framework classification and risk scoring are rules-based. Customer data is never used to train or improve any model.
Backups: manual snapshots today
In progress
Supabase Free provides no point-in-time recovery. Backups today are manual pg_dump snapshots, held in two locations and verified by SHA-256 checksum. Continuous PITR arrives with the Supabase Pro upgrade, targeted before commercial launch on 1 November 2026. Retention window, cross-region replication and RTO/RPO figures will be stated here once Pro is live and a restore has been tested.
Data protection

How your data is protected.

Encryption in transit
All data transmitted to and from ThemisIQ is encrypted using TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled.
Encryption at rest
All data at rest is encrypted using AES-256 at the storage layer via AWS-managed encryption keys.
Account isolation
Your data is isolated at the database level. Row-Level Security is enabled on every table and scoped to the authenticated user, so one account cannot read another account’s rows. A small number of server-side operations run with elevated database privileges; these are limited to named API routes and are not reachable from the browser.
Audit trail: GHG, CBAM and Bill Review
Every change to your GHG inventory, CBAM disclosure and Bill Review bill-extraction data is written to an audit log by a database trigger, not by the application, so the entry is recorded even if the application is bypassed. Seven tables carry the trigger: the GHG inventory and entry tables, two CBAM disclosure tables, and the three Bill Review job, document and proposal tables. The log is append-only: no update or delete permission on it is granted to any signed-in account. Other modules are not yet covered.
Access control

Who can access your data.

Account-level access
Your data belongs to the account that created it, and access is per account: signing in with your own credentials is what reaches your data, and no other account can. ThemisIQ does not offer shared team accounts or per-user permissions within an organization.
Who operates ThemisIQ
ThemisIQ is operated by its founder, with one named deputy for continuity. Production access is held by those two accounts and no others. There is no support organisation with standing access to your data, and no third party administers the platform on our behalf. Our staff who review bills open the bills you upload through our review tools, to read them for inventories read by a ThemisIQ specialist, and every opening in those tools is logged.
Multi-factor authentication
Every account with production access (Supabase, Vercel and GitHub) has multi-factor authentication enrolled via authenticator app. We recommend enabling MFA on your own ThemisIQ account as well.
Incident response

What happens if something goes wrong.

01
Detect
Detection is by notification from the providers that run our infrastructure (Supabase, Vercel, GitHub and Stripe) and by reports to security@themisiq.co, which is monitored with push notification. Automated alerting on our own systems is not configured.
02
Contain
P1 incidents are contained within 1 hour of detection. Affected systems are isolated immediately.
03
Notify
You are notified within 24 hours of a confirmed data breach affecting your data. Regulatory notifications within 72 hours.
04
Review
Every P1 and P2 incident has a mandatory post-incident review within 14 days. Findings shared with affected customers on request.
Vulnerability management

Keeping the platform secure.

✓
Dependency monitoring: Third-party dependencies are monitored continuously by GitHub Dependabot, which raises an alert and opens a pull request with the patched version when a known vulnerability is published. The infrastructure beneath the application is operated by Vercel and Supabase, whose certifications cover it.
✓
Patching: Dependabot opens a pull request for each patched version automatically. Merging is a manual review step gated on the full test suite passing, so a fix reaches production once it has been reviewed and the build is green. A fixed remediation window is not published.
✓
Build gate: Every deploy runs the full test suite and a strict TypeScript check before the application is built. A failing test or type error stops the deploy.
✓
Secrets management: API keys and credentials are held in environment variables and are never committed to source code. GitHub secret scanning is enabled on the repository and covers the full commit history, not only the files currently checked in.
Report a security issue

Responsible disclosure.

If you discover a security vulnerability or believe you have seen suspicious activity in your ThemisIQ account, please contact us immediately. We take all security reports seriously and will respond within 24 hours.

Security team: ThemisIQ Compliance Inc.
Email: security@themisiq.co
Response time: 24 hours for all security reports
We do not pursue legal action against researchers acting in good faith.
Enterprise security reviews
If you are conducting security due diligence, send your questionnaire to security@themisiq.co and we will complete it. ThemisIQ does not yet hold a SOC 2 report or an independent penetration test report, so those artefacts are not available; the certification table above gives the current position and target dates.