Security

Last updated: September 20, 2026

This page describes how CommitPath AI protects your data. It's written to answer the questions security teams actually ask, including the things we don't have yet.

Where Your Data Lives

CommitPath is hosted entirely in the United States.

• Application servers and database: Render, in Oregon.
• Web app and marketing site: Vercel.

Render has a SOC 2 Type II report. We do not — see What we don't have yet.

Encryption

In transit. Every connection uses TLS. Our API and app send HTTP Strict Transport Security, so browsers refuse to connect over plain HTTP after the first visit. Database connections are encrypted with provider-managed TLS certificates.

At rest. Our database and its backups are encrypted at rest with AES-256 by Render.

Application-level, on top of that. The access and refresh tokens for your connected accounts — Salesforce, HubSpot, Slack, Google, Microsoft, DocuSign — are the keys to systems outside CommitPath, so they are never stored in readable form. Each is encrypted with AES-256-GCM using a key held outside the database, with a unique initialization vector per value and an authentication tag that makes silent tampering detectable. Someone with a copy of our database still could not read them.

Accounts and Access

• Passwords are hashed with bcrypt (cost factor 12). We never store or transmit them in readable form and cannot see them.
• Breached passwords are refused at signup. New passwords are checked against the Have I Been Pwned corpus using its k-anonymity range API, which means only a five-character hash prefix leaves our servers — the password itself never does.
• Sessions use httpOnly cookies, so page scripts cannot read them, with SameSite protection against cross-site use.
• Single sign-on (SAML, through WorkOS) is available. It is not something you switch on yourself — tell us you need it and we will set your organization's connection up with your IT team, which takes them about ten minutes. Once connected, your users sign in with their work email and are provisioned on first login. It comes with teams of fifteen or more, because our identity provider charges us a flat monthly fee per company connected rather than per person. Two limits worth knowing before you ask: there is no SCIM directory sync yet, so removing someone who has left your company is a manual step here — though your identity provider stops them signing in immediately — and single sign-on runs alongside password login rather than replacing it, so SSO-only access cannot be enforced yet.

Who Can See What

Access follows role, and it's enforced on the server, not merely hidden in the interface:

• Reps see their own deals.
• Managers see their own deals and those of everyone beneath them in the reporting line — a director sees their managers and those managers' reps, however deep the org chart goes.
• Executives see the whole organization. They are also the only role that can change someone else's role, manage billing, configure single sign-on, export the organization's data, or delete the account.

Organizations are isolated from each other. Every privileged or destructive action — role changes, reporting-line changes, deal reassignment, billing changes, integration connections, single sign-on configuration, invitations, data export, account deletion — is recorded in an audit log. Executives read it in the app, under Team, grouped by day and filterable by whether you are asking about people and access, integrations, or billing and data. It is read-only for everyone, including us: there is no way to edit or delete an entry, because an audit log that can be changed is not an audit log.

Payments

Card details are handled entirely by Stripe and are never sent to, processed by, or stored on our servers. We hold a Stripe customer reference, nothing more.

AI Features

AI features call Anthropic's API for each request. Your content is not used to train models. Nothing is sent to any AI provider except the content needed for the feature you invoked — notes you paste for extraction, or a deal's own signals for coaching.

There is also an enforced monthly cap on AI usage per organization, which exists to make runaway usage impossible rather than merely unlikely.

Backups and Recovery

The production database has point-in-time recovery with a three-day window, and its backups are encrypted at rest. Source code is mirrored weekly to separate storage, and a restore is verified on each run rather than assumed.

Keeping the Software Patched

• Automated dependency alerts and security fixes are enabled on every repository.
• Continuous integration runs the full test suite and an audit of production dependencies on every change, before it can be merged.
• No credential can be committed by accident — a pre-commit check refuses anything shaped like a live key.

Data Retention and Deletion

You can delete your account at any time, which deletes your organization's data. If a subscription ends and is not resumed, the organization's data is deleted automatically after 12 months.

You own your data. What we collect and why is set out in the Privacy Policy, which also lists every sub-processor.

Accessibility

Every screen can be operated with a keyboard alone, and the app is usable with a
screen reader: interactive controls are real buttons and links with names, focus
is always visible, and the workspace's numbered steps are announced as the
sections they are. If something in the product turns out to be unusable for
someone on your team, tell us — we treat that as a bug, not a feature request.

What We Don't Have Yet

We would rather you learn this here than discover it in a questionnaire:

• No SOC 2 report. Our hosting provider has one; CommitPath itself has not been audited. If your procurement process requires it, tell us — it's a matter of when, not whether.
• No third-party penetration test has been performed.
• Single region. Everything runs in one US region. There is no cross-region failover.
• CommitPath is a small company. There is no 24/7 security operations center. Issues are handled directly by the people who built the product.

Reporting a Vulnerability

If you believe you've found a security problem, email support@commitpath.ai with the details and how to reproduce it. We'll acknowledge it, keep you informed, and won't pursue anyone who reports something in good faith and doesn't access or alter other people's data while investigating.