Outsource by The Good Picture

Legal

Security

How Outsource protects your data — hosting, encryption, access control, vendors, and how we respond to incidents.

Version 2.0Last updated 1 August 2026Effective 1 August 2026
On this page
  1. 1.Our approach
  2. 2.Data hosting & residency
  3. 3.Encryption
  4. 4.Access control & tenant isolation
  5. 5.Application security
  6. 6.Vendors & inherited assurances
  7. 7.AI security
  8. 8.Backups & availability
  9. 9.Incident response & breach notification
  10. 10.Data retention & deletion
  11. 11.Responsible disclosure
  12. 12.Contact

1.Our approach

Outsource is built by a focused team that treats security as part of the product, not an afterthought. We keep our attack surface small, store data with reputable, independently-certified providers, and apply the principle of least privilege throughout. This page describes the measures actually in place today; we update it as our posture matures.

We are candid about our stage: we do not yet hold formal third-party certifications such as SOC 2 or ISO 27001. What we do have is a small, well-understood system, strong data residency, encryption everywhere, and the inherited assurances of the certified infrastructure we build on (below).

2.Data hosting & residency

  • Your primary data — accounts, content, files — is stored in Supabase, hosted in the European Union (Frankfurt).
  • The application runs on Vercel (US / global edge). Workflow automation (n8n Cloud) runs in the EU.
  • The full list of infrastructure providers, what each processes, and where, is on our Sub-processors page.

3.Encryption

  • In transit: all traffic is served over HTTPS/TLS. We enforce HSTS so browsers only connect over TLS.
  • At rest: the database and file storage are encrypted at rest by our infrastructure provider.
  • Integration tokens: OAuth tokens for connected accounts (e.g. LinkedIn) are encrypted at rest and used only to perform actions you initiate.

4.Access control & tenant isolation

  • Row-level security. Client data is isolated at the database level with Postgres row-level security, so one workspace cannot read another’s data.
  • Least privilege. Privileged (service-role) access is separated from user-session access and used only where strictly necessary; day-to-day reads run under the signed-in user’s own permissions.
  • Authentication. Accounts are managed through Supabase Auth; passwords are salted and hashed, and sessions use secure, HTTP-only cookies.
  • Roles. Workspace owners control who has access and what each member can do; removing a member ends their access immediately.
  • Staff access. A named member of The Good Picture team can open your workspace to provide support and produce your content. Every such session is opened explicitly, recorded with the person, the workspace and the time, and the actions taken during it are logged. We do not browse client workspaces outside that mechanism.

5.Application security

  • Security headers on every response — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy.
  • Server-side validation and authorisation on state-changing requests; uploads are type- and size-validated.
  • Error monitoring and diagnostics via Sentry, so issues are caught and investigated quickly.
  • Dependencies are kept current, and changes ship through a reviewed pipeline with preview environments before production.

6.Vendors & inherited assurances

We rely on a short list of reputable sub-processors, each engaged under a data-processing agreement with Standard Contractual Clauses where relevant. Several are independently certified, and we inherit those assurances:

  • Supabase — SOC 2 Type II; database, auth, and storage in the EU.
  • Vercel — SOC 2 Type II; hosting and edge network.
  • Anthropic — our AI provider; content sent to AI features is not used to train models.
  • Paystack — PCI-DSS Level 1; all card data is handled by Paystack and we never see full card numbers.

See the complete list on our Sub-processors page.

7.AI security

AI-assisted features are provided by Anthropic. Content you send to these features is not used to train the underlying models, and a person always reviews AI output before anything is delivered or published — there is no solely-automated decision with a significant effect on you.

8.Backups & availability

Data is stored on managed Postgres infrastructure with encryption at rest. We are progressively strengthening our backup and disaster-recovery posture as we scale. This version of the Service is provided on a best-effort basis without a formal uptime SLA; see our Terms of Service for details.

9.Incident response & breach notification

If we become aware of a personal-data breach likely to result in a risk to your rights, we will notify affected users and, where required, the relevant supervisory authority within 72 hours, in line with GDPR Articles 33–34 and the equivalent Kenyan requirements. Our internal process is to contain, assess, remediate, and communicate.

10.Data retention & deletion

We keep data only as long as needed, then delete or anonymise it. You can ask us to export or delete your data at any time and we action it within 30 days — see the Privacy Policy retention table and the Data Deletion page.

11.Responsible disclosure

If you believe you have found a security vulnerability, please email contact@thegoodpicture.com with details and steps to reproduce. We will acknowledge your report, investigate promptly, and keep you updated. Please give us a reasonable chance to fix an issue before disclosing it publicly, and do not access or modify data that is not yours.

12.Contact

Security or compliance questions — including requests for a DPA or our sub-processor list — go to contact@thegoodpicture.com. The Good Picture — Nairobi, Kenya.