SureSteps Trust Center

Architecture & data flow

A high-level view of how a request flows through SureSteps. For the detailed, per-component breakdown, contact info@suresteps.io.

Application data persists to encrypted storage within the SureSteps Platform (see Persisted vs. transient, below).

Third-party integrations, at a glance

SureSteps integrates with roughly four categories of third-party services — identity & communications (login, video/voice, error monitoring), workflow automation (per-organization workflow instances connecting to a customer's CRM), AI/ML processing (a proxied LLM gateway, transcription, and embeddings), and data storage (database, object storage, vector search) — spread across three internal components: a web application, a backend API, and an asynchronous processing worker. If your security team needs more than this summary, contact info@suresteps.io for a full subprocessor list with SOC 2/DPA status for each vendor, and a detailed architecture diagram broken down per internal component.

Persisted vs. transient

Encryption

In transit: all connections listed above use TLS 1.2 or higher, consistent with standard AWS and CloudFront defaults. At rest: confirmed via AWS audit — Postgres and S3 are both encrypted, plus an additional application-level encryption layer for sensitive organization fields. Encryption uses AWS-managed keys, not customer-managed KMS keys — a single SureSteps-controlled key boundary rather than a key per customer.

Data deletion on contract termination

Customer data is deleted within 7 days of contract termination.

Backup & disaster recovery

The primary database runs automated backups with a 30-day retention window in production (7 days in non-production environments), encrypted at rest. Production has deletion protection enabled and always retains a final snapshot before a database could ever be removed. All object storage (file uploads, application data, static web assets) has versioning enabled, protecting against accidental overwrite or deletion. Production database failover is provided by a dedicated standby instance. A documented disaster-recovery runbook exists internally but has not yet been tested against a real restore, and cross-region replication is not yet in place — stated plainly here rather than implied.

Subprocessors

A full list of third-party subprocessors — what each touches, purpose, and SOC 2/DPA status — is available on request; contact info@suresteps.io. (Data handling and retention specifics for the AI/model layer specifically are covered directly in AI Governance, below, since those are relevant to every reviewer regardless of the full vendor list.)

SureSteps provides at least 14 days' written notice before engaging a new subprocessor that will process customer data.

AI Governance

Model selection. Claude Sonnet 4.6 handles the interactive chat/RAG copilot experience, where response quality matters most and a user is actively waiting. Claude Haiku 4.5 handles higher-volume, less latency-sensitive tasks: content generation, summarization, image captioning, and knowledge-search relevance filtering.

Data isolation between customers. Every tenant-scoped record in Postgres carries an organization identifier, consistently filtered on by every query. Knowledge-base embeddings for all organizations live in a single shared Qdrant collection; isolation is enforced by a mandatory organization-id filter applied to every search, checked against the requesting user's allowed access before the query runs — filter-enforced logical isolation, not physical partitioning.

What's sent to the model vs. what stays internal. Only the prompt content needed for a specific request passes through Braintrust to the model — the underlying system-of-record data in Postgres and S3 is never sent wholesale.

Data retention — stated precisely, not as one blanket claim. Anthropic retains API inputs/outputs for up to 7 days, solely for abuse prevention and safety monitoring — not for training. Braintrust, as the proxy in front of Anthropic, separately retains full prompt/response traces for up to 14 days, for the same purpose — also not for training. Neither window is indefinite.

Human review before AI-generated content reaches a technician. Two distinct controls: a customer-configurable workflow places a completed field job on hold for supervisor review, and separately, AI-generated procedure content is written only to a draft version — no AI tool can publish directly, and a technician only ever executes against an explicitly published version requiring a deliberate human publish action. Stated precisely: that publish step is a generic edit-permission check, not a dedicated independent-reviewer role, so the same person who drafted via the AI copilot could also be the one who publishes.

Adversarial security testing. SureSteps runs testing against indirect prompt injection — malicious instructions embedded in retrieved documents or knowledge-base content, rather than typed directly by a user. This is an active part of the AI security process.

Secure SDLC

Every change goes through CI on pull request before merge: build, lint, unit tests per application, and a full end-to-end test suite against a real database. Directory-based required reviewers are enforced via CODEOWNERS.

Dependency scanning runs weekly across every application and shared library via GitHub Dependabot. Static analysis (SAST) is not currently enabled — GitHub's default CodeQL setup requires a paid license on a private repository, so this is tracked as a future decision rather than left unaddressed silently. Container images are scanned on push.

Three environments (local, dev, prod) with separately scoped configuration and secrets. Promotion from dev to prod is a manually-triggered deployment requiring QA sign-off from all team leads.

Compliance roadmap. SureSteps is actively evaluating SOC 2 certification through a compliance automation platform (e.g. Vanta), targeting SOC 2 Type I within 2-3 months and Type II within 6-8 months of starting the engagement. This is a high organizational priority.

Access control. MFA is enforced on every administrative system used to operate SureSteps — AWS, Google Workspace, GitHub, n8n admin, and Auth0. A documented offboarding process (access revocation plus deletion certification) has been exercised in practice, not just written down.

Personnel security. Security awareness is covered as part of onboarding today rather than as a standalone tracked training program, and formal background checks aren't yet in place — access to production systems is currently limited to SureSteps' founding team, stated plainly rather than implied as more formal than it is.

Logging & Monitoring

Sentry alerts on error-rate thresholds today. There is currently no centralized structured log aggregation or SIEM — stated plainly here rather than glossed over.