Trust and security

Credentials Saral holds

Saral is working towards its first independent credentials. Each one appears here, with its reference number, on the day it is granted.

Certificates held by the providers Saral runs on

These certificates belong to the providers named, not to Saral. They cover the infrastructure underneath the parts of Saral each provider runs.

• Supabase: SOC 2 Type 2 and ISO 27001 (database and storage)

  Saral's database, authentication and file storage run on Supabase, which holds SOC 2 Type 2 and ISO 27001.

  Supabase's security page

• Vercel: SOC 2 Type 2 and ISO 27001 (hosting)

  Saral is hosted on Vercel, which holds SOC 2 Type 2, ISO 27001 and a PCI DSS attestation.

  Vercel's security page

• Anthropic: SOC 2 Type 2, ISO 27001 and ISO 42001 (AI processing)

  Documents Saral reads with AI are processed by Anthropic, which holds SOC 2 Type 2, ISO 27001 and ISO 42001 and does not train on them.

  Anthropic's security page

• Microsoft: SOC 2 and ISO 27001 (Microsoft 365 mail and documents)

  Connected mailboxes and documents stay in the customer's own Microsoft 365 tenant, covered by Microsoft's SOC 2 and ISO 27001 reports.

  Microsoft's security page

How Saral protects your data

• Connection tokens encrypted

  Xero and Microsoft access tokens are encrypted by the application before they are stored, with keys held outside the database.

• Each customer's data kept apart

  Every table has row level security switched on, and every request is checked against the customer account it belongs to before any record is read or changed.

• Two-step verification

  Two-step verification (an authenticator app, a passkey or Microsoft sign-in) is required for every office user and every Saral operator.

• Tamper-evident audit trail

  Changes to business records are logged in the same transaction as the change, cannot be edited or deleted, are sealed nightly with a chained SHA-256 hash, and are kept for seven years.

• Private documents

  Documents, receipts, IDs and signatures are kept in private storage and opened only through links that expire within an hour.

• Hosted in the EU

  The database and file storage run in the EU (Ireland). Every service that can touch customer data is listed on the subprocessors page.

• Secrets and errors watched

  Every change to the code is scanned for leaked credentials before it can be released, rotated secrets are recorded, and production errors are monitored.