Trust
Your measurement stays yours.
Bringing years of proprietary Brand Lift research into one place makes your next decision sharper — which is exactly why it has to stay yours. Your security team will weigh this carefully, so we’ve made the answer easy: everything below is a control they’ll ask about, and every line is true today — verified against the product, not the roadmap.
How your data is protected
Controls your review will ask for
Your own workspace
Your reports and everything derived from them live in your organization's workspace — never pooled with any other company's data.
Isolation enforced by the database
Every read runs under Postgres row-level security, forced at the database — including the SQL behind natural-language answers. A query without your organization's context returns nothing.
Encrypted, private storage
Uploaded reports sit in a private bucket, encrypted at rest, with no public URLs. Files are reached only by the server, never exposed to the browser.
Access you control
You decide who in your organization can see and do what, by role. Permissions are checked in the application and enforced in the database.
A complete audit history
Every data access, permission change, and review decision writes an audit row, visible to your administrators — who touched what, and when.
Every figure traceable
Each result cites the page of the report it came from. Low-confidence extractions are held for human review, never silently published.
The stakes
This is the most sensitive data you’ll ever hand a vendor. We built for that.
Years of Brand Lift research is your sharpest read on your own market — the last thing you’d want pooled with a competitor’s or leaked. Most software treats an upload as an upload. Sonaflo was built the other way: your measurement stays in your own workspace — yours to see, yours to revoke, never mixed with anyone else’s.
Subprocessors
The services Sonaflo relies on to run the product:
- Supabase— database, file storage, authentication
- Anthropic— report reading and insight generation
- Vercel— hosting
- Resend— transactional email
- Inngest— background processing
- Google Analytics— marketing site only — no analytics run inside the product
What we don’t claim
Sonaflo does not currently hold SOC 2, ISO 27001, or other formal certifications, and does not offer SSO or customer-managed encryption keys today. When that work is done, it will be stated here — never before. We would rather be trusted for what is true than impressive on paper.
Retention and deletion terms are set out in our data processing agreement. Security questions and incident reports: hello@sonaflo.com.
Trust it with the real thing.
Bring your Brand Lift Studies into a workspace that treats them like what they are — years of proprietary research, and the starting point for your next campaign.