Privacy & Security
Security, privacy, and compliance at Decisions Lab.
Decisions Lab (Almita Limited) is a company building AI-powered simulation tools for understanding human behavior.
Core application data is primarily hosted in Singapore on Supabase. Application execution uses Vercel (including Singapore and US regions). Some supporting services may process data outside Singapore, including in the United States.
Our stack includes Vercel, Supabase, StackAuth, Stripe, PostHog, OpenAI, and AWS (including Bedrock for product AI). Payments are handled by Stripe; we do not store full payment card details.
Authentication is managed by StackAuth. Customer-connected mailbox access may use supported Gmail OAuth or customer-configured SMTP and IMAP providers. All database access is protected by Row-Level Security (RLS) policies.
Security Highlights
Encryption
TLS 1.3 in transit, AES-256 at rest. SMTP credentials encrypted in database.
Row-Level Security
Supabase RLS policies enforce strict user-based data access controls.
AI providers
Product AI uses OpenAI and AWS Bedrock with zero data retention.
PCI Compliance
Payment processing via Stripe. We never store card details.
Compliance
Decisions Lab does not currently have a completed SOC 2 report and is not yet formally in audit. Our roadmap targets SOC 2 Type I with an initial scope focused on Security criteria. Until then, we can share our security overview, subprocessors, data residency summary, and related diligence materials on request.
Subprocessors
Core providers support hosting, storage, authentication, payments, analytics, AI, and messaging. Connected mailbox flows (such as Gmail OAuth or your own email provider) depend on how you configure the product.
| Company | Purpose | Location |
|---|---|---|
 | Application hosting and execution | Singapore; United States |
 | Core database and storage | Singapore |
 | Authentication and user management | United States |
 | Payment processing | United States |
 | Product analytics and telemetry | United States |
 | Transactional email and notifications | United States |
 | AI feature processing | Vendor-managed |
 | AI and infrastructure (including Bedrock) | United States |
Have security questions?
Our team is here to help with any security or compliance inquiries.