Security at Conciq

Businesses send us bank statements, contracts, and payroll documents. We treat that as the core design constraint of the platform, not an afterthought. This page describes the controls that are in place today and what is on our roadmap — we would rather be precise than impressive.

Tenant isolation

Conciq is multi-tenant with row-level security enforced in the database itself. Every table carries a tenant identifier and PostgreSQL RLS policies make one customer's data invisible to another — even if application code has a bug. Your knowledge base, files, and request history are partitioned per tenant.

Encryption

All traffic is encrypted in transit with TLS. Data is encrypted at rest (AES-256) in our database and file storage. Card data never touches our systems — payments are handled end-to-end by Stripe.

PII redaction before AI processing

Before any request content reaches an AI model, our redaction pipeline detects and masks sensitive identifiers — SSNs, National Insurance numbers, bank account and card numbers, and similar. The pipeline is fail-closed: if detection cannot run, the request is blocked rather than passed through. AI providers are contractually barred from training on customer content.

Human access controls

Our fulfilment specialists see request content on a need-to-know basis, scoped to the requests they are working on, under confidentiality agreements. Internal tooling is role-based, and every action on a request — who did what, when — is written to an immutable audit trail.

Infrastructure

Conciq runs on SOC 2-certified infrastructure providers: Supabase (database, storage, authentication), Vercel and Railway (hosting), and Stripe (payments). Databases are backed up daily with point-in-time recovery.

Compliance roadmap

• Today: the controls above, a Data Processing Agreement for UK GDPR customers on request, and UK international data transfer safeguards (IDTA/UK Addendum) — see the Privacy Policy.
• On our published roadmap: SOC 2 Type II certification and independent penetration testing. We say "roadmap" because it is one — we will update this page when certification is complete, not before.

Reporting a vulnerability

If you believe you have found a security issue, email support@conciq.com with "SECURITY" in the subject line. We acknowledge reports within one business day and will not take legal action against good-faith research.