Skip to main content
AppAlert

Current controls and independent assurance

AppAlert is an early-stage product. It does not claim certifications it has not earned. This page separates AppAlert controls from provider attestations.

Reviewed

On this page

AppAlert status

AppAlert does not currently hold a SOC 2 report or ISO 27001 certification. No independent penetration-test report is available yet.

Controls in place

  • Microsoft Graph access uses read-only application permissions.
  • OAuth tokens are encrypted before storage.
  • Production traffic uses HTTPS and sends HTTP Strict Transport Security headers.
  • Customer data access is scoped through the signed-in user's organization membership.
  • Application logging rules prohibit secrets, tokens, raw Graph payloads, private keys, and credential values.
  • Notification and Organization Settings audit records use defined 365-day retention and scheduled deletion.

Provider assurance

Vercel publishes SOC 2 Type 2 and ISO 27001:2022 coverage for its platform. Those attestations apply to Vercel, not to AppAlert as a company.

Primary sources