Security and privacy,
built into POPRIX.
POPRIX runs an AI support desk on your customers' conversations, so protecting that data is the product, not an add-on. It stays in the European Union, it is encrypted in transit and at rest, every action is logged, and nothing your customers send is ever used to train a model.
How your data is protected
The controls that run on every conversation.
Encryption and network isolation
Traffic is encrypted end to end with TLS, and data is encrypted at rest with AES-256. The database is closed to the public internet and reachable only by the application.
- TLS in transit, AES-256 at rest
- Database closed to the public internet
- Customer files in a private store with no public URLs
Your data is yours
POPRIX never trains models on customer data, never sells it, and never hands it to anyone for training. Every provider we call is bound by the same commitment in its API terms.
- No model training on your data
- A published sub-processor list you can check
- 30 days' notice before a sub-processor changes
Human approval and spending limits
Every agent works under a spending ceiling. A financial action above it — a refund, a credit, a change to an order — waits in an approval queue until a person releases it.
- A spending ceiling set per agent
- Human approval before money moves
- Actions no policy covers are blocked
A complete, tamper-evident audit trail
Every action is recorded with a timestamp, the acting identity and the reasoning behind it. Records are append-only and hash-chained, so any change to the history is detectable.
- Append-only: no path to edit a record
- Hash-chained, so tampering shows
- Retained at least 24 months (Regulation 10(d))
Backups and recovery
The database is a managed Supabase Postgres with automatic daily backups, so a bad day is a restore rather than a loss.
- Automatic daily backups
- Managed, continuously monitored database
- Restore available on request
Identity and access control
Sign in with a Google account or a single-use email link. A new address opens its own organisation; an address that belongs to an existing organisation is checked against that organisation's member list on every sign-in.
- Google sign-in or single-use email links
- A per-organisation member allowlist
- A signed, verified session on every request
Where your data lives
Your data is stored in the European Union. Model inference runs on Anthropic in the United States.
- Application
- Vercel Functions, Frankfurt (fra1) — European Union
- Database
- Supabase Postgres, eu-central-1, Frankfurt — European Union
- Customer files
- Supabase Storage — European Union, private with no public URLs
- Backups
- Managed Supabase backups — European Union
- Model inference
- Anthropic (United States); a Google Gemini fallback on its global endpoint
Israel holds an adequacy decision from the European Commission, reconfirmed on 15 January 2024, so personal data moves from the European Economic Area to Israel — where POPRIX operates — without Standard Contractual Clauses. Against a US-only processor, that is a practical advantage.
Privacy law, by design
POPRIX is a processor: your organisation owns its customers' data and decides how it is used, and we act on your instructions under a data processing agreement.
Processor under Amendment 13
Under the Israeli Protection of Privacy Law, as amended by Amendment 13 (in force 14 August 2025), your organisation is the controller and POPRIX is the processor. The split is set out in the DPA, and our access to your data is technical, minimal and recorded.
GDPR and CCPA
The platform is built to meet the GDPR and UK GDPR, and the CCPA. Data subject rights — access, correction, erasure and portability — are honoured, and the data is never sold or used for advertising.
Access logging
Every access is recorded — the identity, the time, the component, the type and scope of access, and whether it was granted or refused — and kept for at least 24 months, meeting Regulation 10 of the Data Security Regulations.
Breach notification
If a security incident affects your data, we notify you within 24 hours of discovering it and help you meet your reporting duties, including the GDPR's 72-hour deadline.
Sub-processors
The providers POPRIX relies on to run the service, and what each one receives.
| Provider | What it is used for | Location |
|---|---|---|
| Vercel | Hosting and running the application, and holding its configuration secrets | Frankfurt, fra1 (European Union) |
| Supabase | The database, customer file storage and backups | eu-central-1, Frankfurt (European Union) |
| Anthropic | The Claude models that draft replies and classify incoming cases | United States |
| Google Gemini API | A fallback model, and transcription and text-to-speech for voice notes where a voice channel is enabled | Google's global endpoint |
| TypeSafe | Typed triage decisions — routing and escalation judgments on an incoming case | TypeSafe's own infrastructure |
| OpenAI | Embeddings for search across the knowledge base, and structured extraction as a fallback | United States |
| Deepdub | Text-to-speech for voice notes, where that channel is enabled | European Union |
| Firecrawl | Reading the organisation's own public website to build its knowledge base | United States |
| Resend | Outbound email delivery | Resend's own infrastructure |
| Telegram | The Telegram messaging channel, where it is connected | Telegram's own infrastructure |
| Composio | Connecting the organisation's own systems (Shopify, a mailbox), and only when the organisation connects them on its own account | United States |
| POPRIX il-fetch | Fetching pages from Israeli websites that block traffic from Europe. Not in the path of customer messages | Israel |
We give customers at least 30 days' notice before adding a sub-processor, so there is time to object before any data flows to it. A customer who objects and cannot be offered an alternative may end the affected part of the service without penalty.
Need the full security documentation?
We provide the Regulation 15 security annex — covering architecture, data ownership, access controls, key management, encryption, backups, monitoring and sub-processors — and our data processing agreement (DPA) to your security team under NDA.