Security, privacy, and compliance — honest, current.
Every line below has a status: in place, in progress, or planned with a date. If you’re evaluating COYL for an enterprise rollout, a clinical pilot, or an acquisition diligence, you should know exactly where the program stands. We won’t claim what we haven’t built.
Updated May 24, 2026. Last reviewed: same.
In place
6
In progress
6
Planned
2
14 lines, one status each.
- In place
Encryption at rest
AES-256 across Supabase (Postgres + storage). Vercel encrypted environment variables. Apple/Google encryption for push notification payloads.
- In place
Encryption in transit
TLS 1.3 for all client-server and server-server traffic. HSTS enforced via Vercel headers.
- In place
Row-level security (RLS) on all database tables
Every public-schema table in the COYL database has RLS enabled with no public policies. Service-role bypass is the only access path; anon-key REST exposure cannot read rows.
- In place
Authentication (SSO + MFA)
Clerk-managed identity. SSO via Azure AD / Google Workspace / Okta available on Workspace tier. MFA enforced on admin accounts.
- In progress
Secrets management
Production secrets in Vercel encrypted env vars. Quarterly rotation cadence being formalized; secret-scanning CI being added.
- In progress
Vulnerability scanning
Static analysis via Semgrep at edit time. Dependency scanning via GitHub Dependabot. Third-party penetration test scheduled Q3 2026.
- In progress
Business Associate Agreement (HIPAA)
BAA template drafted (docs/regulatory/baa-template.md). Outside counsel review + upstream BAA execution with Anthropic, Supabase, Vercel, Resend, Twilio, Clerk in progress. Available on request once counsel-reviewed.
- In progress
Breach notification policy
Draft policy in place (docs/regulatory/breach-notification-policy.md) with state-law overlay matrix. Outside counsel review + Security Officer designation pending.
- In progress
Security risk analysis
NIST 800-30 informal risk analysis published internally (docs/regulatory/security-risk-analysis.md). Top-10 gap remediation plan active.
- Planned
SOC 2 Type II
Planned audit window: Q2 2027 (12-month observation period begins Q2 2026). Vanta or Drata as the compliance automation partner — selection pending.
- In progress
HIPAA-eligible architecture
Data layer architected to HIPAA-aligned controls (encryption, access logging, audit trail). Full HIPAA Business Associate status pending the upstream BAA chain + Security Officer designation.
- In place
GDPR + CCPA + state privacy laws
Data deletion path live at /api/v1/user (DELETE). Privacy policy at /privacy describes data classes, retention windows, and third-party processors.
- In place
Subprocessor list
Public list maintained at /privacy. Current subprocessors: Vercel (hosting), Supabase (database), Clerk (auth), Anthropic (model inference), Resend (email), Twilio (SMS), Apple/Google (push).
- Planned
Microsoft 365 Certification
Target submission Q3 2026 alongside the Microsoft Teams AppSource listing. Will publish certification badge when granted.
One channel, three asks.
Report a vulnerability
Email security@coyl.ai. We acknowledge within 1 business day and aim to resolve critical findings within 14 days.
Request a SOC 2 / HIPAA / BAA package
Email security@coyl.ai with your company + use case. Available packages: current security posture summary, draft BAA, breach notification policy, security risk analysis summary.
Privacy questions or data deletion requests
Email privacy@coyl.ai OR delete your account in-app at /settings (data is purged within 30 days per our retention policy).
Subprocessors
Full list maintained at /privacy. We notify enterprise customers via email when the subprocessor list materially changes.
Incident history
Zero security incidents through May 2026. Status page with uptime + any incidents lives at /changelog.
AI for the moment before behavior happens.