Get access
Trust

Security and tenant isolation.

What the platform states it enforces, what it does not, and how to ask for the rest.

Northsun is designed for tenant-scoped caller memory and enrichment on managed edge infrastructure, with conservative logging and narrow secret handling.

Stated controls

Infrastructure

  • Cloudflare Workers host the production API at the edge.
  • Cloudflare Hyperdrive provides Postgres connection pooling.
  • Supabase Postgres stores tenants, contacts, interactions, audit logs, and operational tables.
  • Upstash Redis and QStash support caching, rate limiting, queues, and background jobs.

Tenant Isolation

  • Northsun scopes tenant data at two complementary layers. Application queries filter explicitly by tenant_id, and Postgres Row Level Security acts as the backstop beneath them: the tables holding customer memory carry policies that match rows only against a tenant identifier set on the connection, so a query arriving without that context returns nothing rather than everything. These are not independent checks — both derive from the same resolved tenant. What the second layer defends against is a query that omits its tenant filter, which fails closed instead of reading across tenants.
  • The database role serving API traffic holds neither superuser nor BYPASSRLS and does not own these tables. Table owners and the BYPASSRLS maintenance roles used for migrations and operational work do skip these policies, by design; neither serves API traffic.

API Keys and Secrets

  • API keys are high-entropy credentials and are stored as SHA-256 hashes.
  • Provider credentials are stored as Cloudflare Worker secrets.
  • Per-tenant tenant_secret values are generated in the database and used only for audit-log phone HMACs.
  • tenant_secret values must never be serialized into responses, webhooks, or logs.

Phone Privacy and Audit Logs

  • Northsun audit logs store phone_number_hash, not raw phone numbers. The hash is HMAC-SHA256 over the E.164 phone number using the tenant's tenant_secret. This prevents a shared plain hash from becoming a cross-tenant lookup table.

Logging and Background Failures

  • Operational logs are sanitized to avoid phone numbers, transcripts, summaries, names, enrichment payloads, API keys, webhook secrets, provider tokens, and tenant secrets. Background audit, cache, enrichment, webhook, and dead-letter failures are logged with operational fields such as tenant_id, contact_id, endpoint, status, and error type.

Not enforced — stated plainly

Tenant Isolation

  • Not every table is tenant-scoped, and the exceptions are deliberate. The tenant and API-key registries must be addressable before a request can be attributed to a tenant, so the API role reaches them outside tenant scope. A handful of internal tables hold no customer memory by design and are not tenant-partitioned: an internal ops-receipt ledger, waitlist signups, and a shared enrichment cache of third-party lookup results keyed by phone number, written by the enrichment pipeline.
  • One further exception is a table rather than a schema rule. Memory extraction jobs — the paths that feed our extraction worker — write their failure payload unredacted to an internal dead-letter table when they exhaust their retries, for triage; operational logs of the same failure carry only identifiers, not PII or transcripts. That table is not tenant-partitioned and is reachable only by the server-side API role and maintenance roles, never by public or tenant-scoped clients — it is the one place a failed job's raw content, which can include otherwise tenant-scoped memory, can outlive the request that produced it. Rows there are retained until an operator triages them; we do not currently enforce an automatic retention window on that table, and this page will say so until we do.

Current Compliance Posture

  • Northsun does not currently publish a SOC 2 report, HIPAA BAA, or formal compliance certification. These may be part of future enterprise readiness work, but they should not be assumed unless agreed in writing.

Bring your requirements

Per-engagement architecture questions — data residency, BAA, DPA — are answered in the conversation, not asserted here.

Contact sales

Responsible Disclosure

  • To report a security issue, email abdur@northsun.ai with a clear description, affected endpoint or route, reproduction steps, and potential impact. Northsun does not currently operate a paid bug bounty program.

Questions?

  • This page is published by Northsun Enterprise LLC, a New Jersey limited liability company (“Northsun”, “we”, “us”).
  • Contact abdur@northsun.ai. Enterprise terms, DPA requests, and security review materials can be handled through the same contact.

Last updated October 19, 2026