Security and data
Where the data lives, and who can reach it.
Written for the person who has to sign the DPIA. Everything below describes what the product does today, not what is planned.
Storage
Everything we keep is kept in the UK
The database, the file storage and the application run in the London region on Supabase and Vercel. No transcript, recording or report is stored anywhere else.
Processing
A conversation is processed outside the UK
Where data is stored and where it is processed are different questions, and a DPIA asks both. To choose the interviewer's next question we send what has been said so far to an AI model provider; a spoken conversation also passes through a speech provider. Both process outside the UK. We store nothing with them, and the model providers' API terms say they do not train on what we send. Each one is named below with the region it processes in, and we will not add to the list without telling you first.
Isolation
Row-level security on every table
An authority's data is separated in the database itself, not in application code. Every table carries a policy, so a query that forgot a filter returns nothing rather than someone else's study.
Accountability
An append-only audit log
Opening a transcript, exporting a report, changing a guide, inviting a supplier: each writes a line that can be read but never edited or deleted. The log is the answer to a procurement challenge.
Sign-in
Work addresses, and a domain allow-list
Officers sign in with their work address, by a one-time link or a password. An authority can restrict sign-in to its own email domains, so a personal address cannot be added by accident.
Suppliers
No scoring, and quote rules the database enforces
Nothing a supplier says is scored or graded, and no answer is attached to a bid. An answer marked confidential still informs the report's themes but can never be quoted: the rule lives in the database, not only in the prompt.
Retention
Six to sixty months, set per authority
Each authority chooses how long recordings and transcripts are kept, within that range, and the figure appears in the disclosure every supplier reads before they start. A supplier can ask for their recording to go sooner.
Telemetry
Allow-listed events, cookieless for suppliers
Product analytics capture a fixed list of events with no free text and no supplier content. The supplier surface sets no analytics cookies at all.
Accessibility
WCAG 2.2 AA, and AAA contrast where it matters
Every screen is built and tested to WCAG 2.2 AA, with axe checks in continuous integration. The supplier surface holds AAA contrast on body text and links, works on a phone, and respects a reduced-motion preference.
Roles
Three roles, and nothing in between
- Admin
- Everything, including settings, the team and the reply-to address.
- Officer
- Runs studies and the panel. Can't manage the team or the reply-to address.
- Viewer
- Read-only across studies, transcripts and reports.
Subprocessors
Everyone who touches the data, and where
The whole list, not a summary, so a DPIA can be written against it rather than against “we use AI”. We will tell you before we add to it.
- SupabaseUnited Kingdom (London)
The database, the file storage and the recordings. Everything we keep, we keep here.
- VercelUnited Kingdom (London)
Runs the application and serves every page.
- Anthropic or OpenAIUnited States
Drafts the guide, chooses the interviewer's next question, and writes the report. Sees the conversation. One of the two — ask us which, and we will tell you before you sign anything.
- ElevenLabsUnited States
Speech, for a spoken conversation and for the voice samples an officer listens to in the builder. Sees the audio.
- ResendUnited States
Sends invitations and reminders. Sees the recipient's address and the message.
- PostHogEuropean Union
Product analytics, from an allow-list of events. Sees no content and no addresses.
- SentryUnited States
Errors, scrubbed to the same allow-list. Sees no content and no addresses.
Support access
We cannot look without asking first
Soundings staff do not read transcripts in the ordinary course of running the service. When support needs to see what you are seeing, a member of our staff can enter your workspace only after someone at your authority agrees to it, and we record who agreed and how. That session carries a banner on every page, ends after 24 hours or sooner, and is written into your own audit log, where you can read it back without asking us.
Questions from a DPO or an IT team go to support@astario.co.uk. If you are a supplier who has been invited to a conversation, this page is for you.