Built to earn your trust.

The Pomelo Labs platform runs on two primary infrastructure providers — Vercel and Supabase — both of which hold SOC 2 Type II certification, meaning they undergo annual independent audits of their security, availability, and confidentiality controls.

• ✓Application layer: Next.js 16 application hosted on Vercel. Server-side routes handle authenticated API traffic and Vercel delivers static assets through its managed network.
• ✓Database and auth: Supabase provides PostgreSQL database hosting with built-in row-level security, Supabase Auth for user authentication, and Supabase Storage for file uploads.
• ✓AI inference: API calls to OpenAI and Anthropic are made server-side from Vercel functions. Your data never flows directly from the browser to AI providers.
• ✓Payments: Stripe handles all payment card data. Card numbers are tokenised by Stripe.js before reaching Pomelo Labs servers; we store only the last four digits and card type.
• ✓Data isolation: user-facing records are scoped to an organisation. Server-side authorization and database row-level security policies are tested against separate viewer, editor, admin, and cross-organisation fixtures before release.

• ✓In transit: production traffic is served over HTTPS using the TLS configuration managed by Vercel and our infrastructure providers.
• ✓At rest: all data stored in Supabase (database rows, file uploads) is encrypted at rest using AES-256, managed by Supabase's infrastructure-level encryption.
• ✓OAuth tokens: integration tokens are held server-side, encrypted at rest by Supabase (see above), and access-scoped to your organization. They are used only during server-side API calls on your behalf, and are never returned to the frontend or logged.
• ✓Environment secrets: API keys for OpenAI, Anthropic, Stripe, DataForSEO, and Firecrawl are stored as encrypted environment variables in Vercel and are never exposed in client-side code or git history.

• ✓Authentication is handled by Supabase Auth, which implements industry-standard JWT-based sessions with short expiry windows and refresh token rotation.
• ✓Passwords are hashed using bcrypt with an appropriate work factor. We never store plaintext passwords.
• ✓Google OAuth is available as a sign-in method. We request only the minimum OAuth scopes required for sign-in (openid, email, profile) and separate integration-specific scopes are requested only when you connect a specific integration.
• ✓Application sessions are managed through the official Supabase SSR client and refreshed through server middleware. We do not claim HTTP-only session storage because the current Supabase SSR cookie implementation is readable by application JavaScript.
• ✓Multi-factor authentication is not currently exposed in the Pomelo Labs account interface. This page will be updated when that control is implemented and verified.

Within each organisation, Pomelo Labs enforces role-based access control (RBAC) with three roles:

Organisation Admins can invite, remove, and change the roles of team members from Settings → Team at any time. Pomelo Labs engineering staff access production systems only through a separate privileged access mechanism with audit logging. Staff with production database access are limited to those whose roles require it.

• ✓OpenAI: selected image and language operations use the OpenAI API. Retention and training treatment follow the API account and endpoint settings in effect at the time of processing.
• ✓Anthropic: most language-generation operations use the Anthropic API. Retention and training treatment follow Anthropic's commercial API terms and our active account settings.
• ✓DataForSEO: keyword and SERP data is fetched on-demand based on your queries. We do not send your website content or brand data to DataForSEO.
• ✓Firecrawl: your website is crawled once during onboarding to extract content for brand voice analysis. This crawl data is processed in memory and is not retained as training data.
• ✓Pomelo Labs does not build or fine-tune proprietary AI models using customer data.

• ✓Database backup and recovery capabilities depend on the active Supabase project plan and configuration. We verify the production configuration before publishing a specific retention commitment.
• ✓Brand assets and generated images are stored in Supabase Storage. Object versioning is not currently represented as a customer-facing recovery feature.
• ✓Application deployments are maintained through Vercel. Database migrations are first rehearsed against a separate Supabase test project.
• ✓Customers evaluating contractual RPO, RTO, backup retention, or disaster-recovery requirements should request the current control record before relying on a specific target.

We maintain an internal incident response plan with defined escalation paths, severity classifications, and communication timelines.

• ✓Detection: security events are monitored via Supabase audit logs, Vercel access logs, and application-level error tracking.
• ✓Triage: on-call engineering triages all potential security events within 4 hours of detection.
• ✓Containment: affected systems are isolated and credentials rotated as soon as an incident is confirmed.
• ✓Notification: affected users are notified within 72 hours of discovering a personal data breach, in compliance with GDPR Art. 33–34. We also notify relevant supervisory authorities within the required timeframes.
• ✓Post-incident: we conduct a root cause analysis after every confirmed security incident and publish a remediation summary to affected customers.

To report a security vulnerability, email security@pomelolabs.ai. We aim to acknowledge all reports within 24 hours and provide a remediation timeline within 5 business days. We do not pursue legal action against security researchers who disclose vulnerabilities responsibly.

• ✓Data export: you can export all your projects, content, analytics history, and account data as a JSON archive from Settings → Data Export at any time. No need to contact support.
• ✓Account deletion: Settings → Privacy & Data cancels a sole-member workspace subscription first, removes workspace Storage objects and database rows, and then deletes the authentication account. If a required step fails, the operation stops with a retryable error. Legally required billing records may be retained separately.
• ✓Integration revocation: disconnect any integration (Google, Webflow) from Settings → Integrations. This immediately revokes the stored OAuth token.
• ✓Content deletion: individual content items, projects, and agent outputs can be deleted from within the platform at any time.

For additional requests — including access to data not available via self-service export, or if you need a formal data portability export in a specific format — contact privacy@pomelolabs.ai.

Email our security team at security@pomelolabs.ai. For privacy requests, use privacy@pomelolabs.ai. We aim to respond within 24 hours.