HTTPS everywhere, AES-256-GCM for connected credentials, hashed API tokens, per-org data scoping with Postgres RLS on sensitive tables, zero data retention across all AI providers, and Better Auth sessions.
No SOC 2 yet. No enforced MFA yet. No contractual data residency yet. SOC 2 Type 1 is planned when customer demand justifies the investment.
Talk to us at security@medialyst.ai before procurement — we'll meet you in the middle on most enterprise asks.
Encryption
Tenant isolation
Customer data is scoped by organization. Sensitive application routes verify that the requesting user or API key belongs to the organization before returning or mutating data. Selected high-value tables also enforce Postgres row-level security as defense-in-depth.
We're actively tightening org-scoping coverage on the remaining routes and expanding RLS across more tables — see the roadmap below.
Authentication
AI providers
Product AI calls (campaign analysis, workflow automation, table operations, journalist/contact classification) route primarily through OpenRouter, which fronts models from Google, Anthropic, and OpenAI. Embeddings and a small set of internal tooling call OpenAI directly.
User prompts, campaign material, scraped company content, workflow rows, journalist names and publication context, contact values, and generated outreach.
PII
PII handled: user names and emails, organization metadata, journalist contact data, media-list/workflow data, connected-account metadata, email-send metadata, campaign content, and operational logs.
Some AI workflows process PII when it's part of the customer prompt, campaign material, or workflow row being analyzed. We redact selected sensitive tokens from operational logs; we don't run automatic PII redaction before every AI call.
Data retention & deletion
Users and organization owners can initiate account or organization deletion. Org-scoped database records cascade on org deletion; user deletion removes the user from marketing audiences and cancels subscriptions.
Backup retention and vendor-side deletion windows vary by subprocessor and will be confirmed in writing for any customer that needs a specific guarantee in their contract.
Audit logging
We log public API requests, OAuth token issuance, connected email-send events, workflow failures, and application errors — used for debugging, abuse investigation, and operational support. Customer-facing audit-log export isn't shipped yet.
Subprocessors
Current as of June 23, 2026. Updated when we add or remove vendors.
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Web hosting + serverless runtime | US (default) |
| Supabase / Postgres | Application database | Confirmed on request |
| Cloudflare R2 | File / object storage (S3-compatible) | Provider-managed |
| Trigger.dev | Background workflow orchestration | US |
| OpenRouter | AI model gateway (Anthropic, Google, OpenAI) | Provider-managed |
| OpenAI | Direct: embeddings on customer content | US |
| Stripe | Billing | US / EU |
| Loops | Product email | US |
| Resend | Transactional email | US |
| Sentry | Error monitoring | US / EU options |
| PostHog | Product analytics | US / EU options |
| Google Gmail API | Optional customer-connected sending | Customer-controlled |
| Microsoft Graph / Outlook | Optional customer-connected sending | Customer-controlled |
| Instantly, Reply.io | Optional customer-connected outreach | Provider-managed |
Roadmap
In rough priority order. We don't commit to dates here.
Reporting a vulnerability
Email security@medialyst.ai. Include: