Compliance status
Insparisk began a SOC 2 (Security) readiness program with Sprinto on 2 September 2026. Security policies, a risk register and a vendor risk register are in place, and we are working toward audit readiness.
We are not SOC 2 certified today. The formal examination will be carried out by an independent CPA firm once the readiness phase is complete, and we will publish the report date and scope here when it is issued.
We would rather tell you this plainly than display a badge we have not earned. If your procurement process requires a completed SOC 2 report today, we will say so up front rather than let it surface late in a security review.
In the meantime, we can complete standard security questionnaires and provide detail on any control described below. Ask your account contact, or write to security@insparisk.com.
How data is protected
Encryption in transit
All traffic to insparisk.com and our APIs is served over HTTPS with TLS, redirected from HTTP, and carries HSTS. Our managed database and object-storage providers require TLS on every connection, and calls to third-party APIs are made over HTTPS.
Access control
Administrative access requires Google single sign-on and is checked against an explicit allowlist of authorised staff, each with a defined role. Roles restrict what a signed-in user can reach — reporting access cannot invoke payment functions.
Database and storage isolation
Row-level security is enforced in our Supabase-backed systems, so records are not readable simply by holding a client key. The Command platform runs on a managed Postgres cluster that is reachable only with server-side credentials, never exposed to the browser. Inspection photos are held in private object storage that rejects unsigned requests and are reached only through time-limited signed links. Reports and signed documents are not published to storage URLs at all; they are served through the authenticated API.
Secrets management
API keys and credentials are held in environment configuration rather than in application code, and are scoped to the specific service that needs them.
Abuse protection
Public forms are protected by bot challenges, and API access is rate-limited per client. Payment attempts pass anti-fraud checks before a charge is ever created.
Browser hardening
Responses from insparisk.com set X-Content-Type-Options: nosniff, X-Frame-Options to block third-party framing, and a strict referrer policy so URLs are not leaked to other sites.
Payments
Card and bank details never reach Insparisk servers. Payment credentials are captured directly by Stripe in the browser and exchanged for a token; we store only that token, the amount, and the invoice it relates to. Stripe is a PCI DSS Level 1 service provider.
This means a compromise of our systems could not expose customer card numbers, because we never hold them.
Where your data is processed
We use a small number of established providers rather than running our own infrastructure. Each is a subprocessor for the purpose listed.
| Provider | Purpose |
|---|---|
| DigitalOcean | Hosting for the IRIS and Command applications, managed Postgres, object storage for inspection photos, and compute for background data jobs |
| Netlify | Marketing website hosting and serverless functions, TLS termination |
| Supabase | Database and authentication for the website and the compliance data pipeline |
| Stripe | Payment processing and card data handling |
| Xero | Accounting and invoicing |
| Resend | Transactional email delivery |
| Cloudflare | Content delivery and TLS for the applications, bot protection on public forms |
| Staff single sign-on, maps, website analytics | |
| Anthropic | AI features that classify and summarise compliance records |
| Sprinto | Compliance automation and control monitoring |
Reporting a security issue
If you believe you have found a vulnerability in an Insparisk product, please write to security@insparisk.com with enough detail to reproduce it. We will acknowledge your report and keep you informed while we investigate.
Please give us a reasonable opportunity to resolve the issue before disclosing it publicly. We will not pursue action against researchers who report in good faith and avoid privacy violations, service disruption or data destruction.
Related
Privacy Policy · Terms of Service · Insparisk Command
Last reviewed 2 September 2026.