AI-IT INC · Affiliate-IT
Trust Center
Security, privacy, and compliance transparency for the Affiliate-IT platform.
SOC 2 Type II roadmap
Affiliate-IT is pursuing a SOC 2 Type II examination covering Security and Privacy trust service criteria. We maintain automated and organizational controls aligned with those criteria, including access management, content security, monitoring, data retention, and vendor oversight. An executive summary will be published here when our formal Type II attestation is available.
- Layered application security and authenticated access to customer data
- Health monitoring and operational status reporting
- Documented incident response and privacy practices
- Regular review of subprocessors and platform dependencies
Security program
We design the platform with defense in depth: encrypted transport, role-based access, tenant isolation for customer content, and retention policies for operational data. Vulnerability reports are reviewed promptly through the contact below. Generated-code assurance includes sandboxing, publish schema limits, dependency audit, and CI security gates.
Subprocessor registry
These vendors process customer data on our behalf. The public schedule below matches our enterprise DPA attachment. Signed DPAs are tracked externally. See also Privacy Policy. Enterprise customers may request the DPA / subprocessor schedule via contact@affiliate-it.com.
| Vendor | Category | Purpose |
|---|---|---|
| Vercel | Hosting | Hosting, deployment, edge functions |
| Supabase | Hosting | Database, authentication, storage |
| Stripe | Payments | Payments and billing (PCI scope delegated) |
| Together AI | AI | Platform AI inference (when Platform key used) |
| OpenAI / Vercel AI Gateway | AI | Optional AI providers (customer BYOK; harness + admin SOC2/CCPA eval required) |
| ElevenLabs | AI | Voice / conversational AI features |
| Google / Analytics | Analytics, OAuth, Ads/Places/GTM (consent-gated where applicable) | |
| Meta / Facebook | Communications | Optional social OAuth / posting |
| Microsoft | Communications | Optional mail OAuth |
AI data governance
Platform AI uses approved providers only, defaults training opt-in to off, retains widget chat for 90 days, and applies prompt minimization for secrets/SPI. High-risk publish outputs require operator review. Details: Privacy Policy (AI section).
Incident disclosure
We investigate security incidents per our incident response plan. Customers affected by a confirmed breach involving personal data will be notified without undue delay and in accordance with applicable law. Report vulnerabilities to admin@affiliate-it.com (see also security.txt). Operational status updates are posted on our system status page.