Attestlane

Privacy Policy — Attestlane

Effective date: 5 August 2026 Entity: Core Brim Tech, Freetown, Sierra Leone Contact: privacy@attestlane.io

1. Who we are

Attestlane ("Attestlane", "we", "us") provides an AI-assisted SOC 2 compliance readiness platform. This policy explains what personal data we collect, why, how we handle it, and your rights.

2. Data we collect

You provide directly:

  • Account data: name, email, password (stored hashed), organization name.
  • Compliance data: questionnaire responses, policies, evidence files, risk and vendor records, personnel records you enter, integration configurations.
  • Billing data: plan selection and payment status. No payment processor is currently integrated. Plans are invoiced directly and activated manually, so we do not collect, process, or store card numbers at all.

Collected automatically:

  • Usage and device data: IP address, browser type, pages visited, timestamps.
  • Cookies/session tokens required for authentication.

Important — customer-controlled personal data: Your organization may enter personal data about third parties (e.g., your employees or vendors) into Attestlane. For that data we act as a processor on your behalf. See our Data Processing Addendum.

3. Why we use it (legal bases)

  • To provide the service and your account (contract performance).
  • To process payments (contract performance).
  • To secure the platform and detect abuse (legitimate interests).
  • To send service and, where permitted, marketing communications (consent / legitimate interests; you can opt out).
  • To comply with legal obligations.

4. Sub-processors

We share data only with vendors that help us run the service:

| Sub-processor | Purpose | Data | |---|---|---| | Render (US · Oregon) | Application + database hosting | All service data | | Groq | AI policy generation, advisor, questionnaire autofill | Compliance data submitted to AI features | | Cloudflare R2 / AWS S3 | Evidence file storage | Uploaded evidence files | | Vercel | Frontend hosting | Usage/device data | | Resend | Transactional email | Name, email | | Sentry | Error tracking | Limited diagnostic data |

A current sub-processor list is maintained on this page and updated when it changes.

5. AI processing

Some features send your compliance data to a third-party AI provider (Groq) to generate policies, answer questions, and draft questionnaire responses. AI output may be inaccurate and must be reviewed before use. We do not use your data to train third-party foundation models.

Under Groq's Services Agreement, Groq is not permitted to use inputs or outputs to train or fine-tune models unless the customer explicitly instructs it, and by default Groq does not retain data from inference requests. Groq may temporarily log inputs and outputs for up to 30 days when troubleshooting platform failures or investigating abuse.

6. International transfers

We are based in Freetown, Sierra Leone. Data is processed in the United States (Render, US · Oregon). Where we transfer personal data of EU/UK residents, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the transfer terms of our sub-processors.

7. Data retention

We retain account and compliance data for as long as your account is active and as required for legal/audit purposes, then delete or anonymize it. You may request export or deletion at any time (Section 9).

8. Security

We use encryption in transit (HTTPS), hashed passwords (PBKDF2-SHA256), encrypted storage of integration credentials (Fernet), access controls, and rate limiting. No system is perfectly secure; we cannot guarantee absolute security.

9. Your rights

Depending on your location you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object or withdraw consent. To exercise them, contact privacy@attestlane.io. California (CCPA/CPRA) and EU/UK (GDPR) residents have the additional rights described in this policy.

10. Children

Attestlane is a B2B product not directed to anyone under 18. We do not knowingly collect children's data.

11. Changes

We will post changes here and update the effective date. Material changes will be notified by email.

12. Contact

privacy@attestlane.io · Core Brim Tech, Freetown, Sierra Leone