Supabase
Database · Authentication · Private storage
Provides the core workspace data layer, user authentication and private storage used by mAIeSTRA.
SOC 2 Type 2ISO/IEC 27001
Provider security & compliance ↗Security & Trust
Your security isn't one of our priorities. It's our first priority.
mAIeSTRA is built on database, cloud and AI systems protected by globally recognized security and compliance standards. We combine that infrastructure with identity-based access controls and workspace-level data separation to protect strategic information.
We explain below what we use, why we use it and how customer data is handled — without overstating the protections or certifications that apply.
Trusted infrastructure
Built on independently audited providers.
We use specialized providers for database, authentication, storage, application hosting and AI-assisted workflows. Their certifications strengthen the infrastructure we rely on, while remaining certifications of the respective providers — not certifications of mAIeSTRA or Impulso Advisors.
Netlify
Application hosting · Delivery
Provides application hosting, delivery and application-side infrastructure for the mAIeSTRA web experience.
SOC 2 Type 2ISO/IEC 27001ISO/IEC 27018PCI DSS v4.0
Provider security & compliance ↗OpenAI
AI-assisted analysis · Generation
Provides selected AI-assisted analysis and generation capabilities initiated inside mAIeSTRA workflows.
SOC 2 Type 2ISO/IEC 27001ISO/IEC 27017ISO/IEC 27018ISO/IEC 27701ISO/IEC 42001CSA STAR Level 1
Provider security & compliance ↗Provider certifications and attestations apply within each provider's own compliance scope. They do not constitute SOC 2 or ISO certification of mAIeSTRA or Impulso Advisors.
How we protect access
Protection follows the data.
Access to customer information is determined by identity, organization membership and permissions — not simply by knowing a URL or record identifier.
01
Workspace-level separation
Customer workspaces are separated using organization-scoped access rules and Row Level Security at the database layer.
02
Role and scope controls
Permissions determine what an authorized user can view or modify inside a workspace, plan, module or field context.
03
Private documents
Workspace documents use private storage controls and are not intended to be exposed as public assets.
04
Encrypted transport
Connections between the application and its core providers use HTTPS/TLS encrypted transport.
Advisor access
Advisor access starts with the customer.
An advisor does not receive access simply by having an mAIeSTRA account. Advisor access begins only after the customer initiates an advisory request and is tied to the selected strategy plan while the advisory engagement is active.
Customer strategy plan→Customer initiates request→Advisor accepts→Plan-level advisory access
Sample document
Advisor Access & Confidentiality Agreement
A short customer–advisor agreement can define permitted use, confidentiality, data handling, deletion and incident notification for the engagement.
View sample terms
- The advisor may use customer information only for the agreed advisory engagement.
- Customer information must remain confidential and may not be disclosed to third parties without customer authorization, except where legally required.
- Advisor access is personal and non-transferable.
- The advisor should avoid unnecessary local copies and protect any information exported for the engagement.
- At the end of the engagement, locally retained customer information should be returned or securely deleted unless retention is legally required.
- Suspected unauthorized access, loss or disclosure should be reported promptly.
- Advisor input supports management decision-making but does not transfer responsibility for business decisions away from the customer.
- When the advisory engagement ends, the advisor must cease using customer information except where retention is legally required.
Illustrative commercial template only. Final wording should be reviewed for the parties, governing law, professional scope, data-protection roles and applicable local requirements.
AI & your data
AI supports the workflow. It does not own the decision.
mAIeSTRA uses OpenAI API services for selected AI-assisted workflows. OpenAI states that API business data is not used to train its models by default.
mAIeSTRA configures supported API requests with application-side storage disabled. This should not be read as a Zero Data Retention claim unless the relevant account-level OpenAI control is separately verified.
AI-generated analysis and content remain inputs to customer decision-making and should be reviewed by the customer or advisor.
Security questions
Straight answers to the questions we expect.
Can another customer see my workspace data?
Customer workspaces are separated through organization-scoped access rules and Row Level Security. Cross-tenant access is not an intended application capability.
Can an advisor see my data?
Only after a customer initiates an advisory request. When accepted and active, advisor access is tied to the selected strategy plan.
Is mAIeSTRA itself ISO 27001 or SOC 2 certified?
No such claim is made. We use infrastructure providers that maintain independent certifications, but those provider certifications do not certify mAIeSTRA itself.
Is my data used to train AI models?
OpenAI states that API business data is not used for model training by default. mAIeSTRA uses the OpenAI API for selected AI-assisted workflows.
Security information is reviewed as the production architecture, provider configuration and data flows evolve. For security, privacy or enterprise due-diligence questions, contact meet@impulsoadvisors.com.