Your data
Last updated: 7 July 2026
You are trusting Assura with descriptions of your security posture - answers, evidence and findings. This page explains plainly where that data lives, how it moves, and what protects it. The legal detail sits in our Privacy Policy; this is the practical picture.
Who we are
Assura is operated by a company registered in England and Wales - the full legal detail is in our Privacy Policy. We are the data controller for your account information and the processor for the assessment content you put into the platform.
Where your data lives
- Application data (accounts, assessments, evidence summaries, reports) is stored in a managed PostgreSQL database hosted on Railway's cloud infrastructure in the United States, protected by the UK GDPR's international transfer safeguards. Our providers encrypt storage at rest.
- The web application and this site are served from Vercel's global edge network.
- Payments are handled entirely by Stripe. Your card details go to Stripe directly and never touch our servers; we hold only the subscription state.
- Emails (verification, receipts, reminders) are sent through Resend from our own domain.
How it moves
- Every connection to Assura is encrypted in transit with TLS - the browser, the API and the database all speak over encrypted channels.
- Passwords are stored only as salted hashes; we cannot read them.
- Access to production systems is restricted to the people who operate the service, using dedicated credentials and multi-factor authentication.
AI processing
Assura's scoring and assistants send the relevant assessment text to a large language model provider to produce scores, reasoning and drafts. Each request is scoped to its single task, your content is treated as data rather than instructions, and outputs are validated before anything is stored. AI outputs are automated analysis - the product tells you to verify them before relying on them, and we mean it.
Your controls
- Export - your assessment data is yours; you can export reports and raw CSV data at any time.
- Delete - you can delete assessments, uploaded evidence, or your whole account from inside the product.
- Retention - deleted data is removed from live systems promptly and from backups on their rotation cycle.
If something goes wrong
We operate under the UK GDPR, including its 72-hour personal-data breach notification duty to the ICO and, where required, to you. Security reports are welcome and read by a human: security@assurasec.com.
Questions
Anything unclear, or anything your own compliance team needs to know before adopting Assura - email privacy@assurasec.com and you will get a straight answer.