Security Overview

Where things stand

SOVRINT Inc. is one person. That person writes the code, runs the service, reads what arrives and would handle any incident. There is no security team, and nobody to review a change or cover an absence.

SOVRINT wrote this page about itself, and nobody outside has checked it. Statements about suppliers are what those suppliers publish.

What does not exist

• No SOC 2 report, ISO 27001 certificate, or FedRAMP, GovRAMP or TX-RAMP status.
• No outside security audit and no penetration test.
• No uptime promise or service level. The Terms say so.
• No written incident response plan, and no promised time for notice.
• No recovery time or recovery point objective.

If your office needs an independent report before it can use a vendor, SOVRINT cannot meet that today.

What SOVRINT holds

The public pages hold public documents. The two forms send SOVRINT what you type. A workspace account holds a name, email and organization, a hashed password, saved work, a log of searches, an access log, and requests and what is delivered on them. The Privacy Policy has the full list.

The workspace is built for public documents. It is not a place for confidential agency material or for personal data about other people, and Data Processing says the same.

Who else is involved

Vercel reports a SOC 2 Type 2 attestation and an ISO 27001:2022 certificate. Those cover Vercel’s platform, not SOVRINT’s code or how SOVRINT runs it. Vercel’s compliance page, read on November 7, 2026, lists no FedRAMP or GovRAMP status.

Signing in

• Accounts exist by invitation only, and the owner approves each one. An invitation link expires after 14 days and stops working once used. The workspace sends no email, so the owner passes each link on by hand.
• Passwords must have at least 12 characters and are stored as salted scrypt hashes. There is no rule on character types and no forced change.
• Every workspace account, the owner’s included, needs a second step after the password: a passkey or a code from an authenticator app. It cannot be turned off. The secret behind app codes is encrypted, and a passkey is stored as its public key only. There is no single sign-on.
• Each account gets ten recovery codes, stored as hashes, and each works once. Someone who has lost all of these needs a recovery link from the owner, which lasts 24 hours and works once. The owner confirms who is asking through a contact already on file first.
• A sign-in is a random token, and only its hash is stored. The cookie is limited to the workspace, is closed to page scripts, travels only over HTTPS and lasts 14 days at most. Closing an account, setting a new password or changing the second step ends its sign-ins.
• Sign-in tries are limited per IP, per email and per both, counted by Vercel’s firewall across all server instances. If the firewall cannot answer, new sign-ins are refused. A wrong password does not lock an account, but too many tries on one email pause new sign-ins to it for up to ten minutes. Five wrong app codes in a row block app codes on that account for 15 minutes.

Keeping customers apart

There are two roles, owner and customer, and the server checks the account on every page and action. All customers share one private store. Each customer’s work sits under its own key, and there is no separate store or encryption key per customer. This separation is enforced by SOVRINT’s own code, and no outside test has tried to break it.

The owner can read everything in the store, including searches and messages. Each customer has an access log, written before the step it describes, which shows when the owner opened that customer’s orders or search log through the workspace. The owner’s lists of orders and accounts add no line, and nothing records what the owner reads directly in the hosting store.

Encryption

Connections use TLS 1.2 or 1.3. On November 7, 2026, a TLS 1.1 connection was refused and plain HTTP redirected to HTTPS. Browsers are told to stay on HTTPS for two years. The domain is not on the browser preload list.

Vercel states that stored files are encrypted with AES-256. Vercel holds those keys. SOVRINT adds no encryption of its own, so stored documents can be read by whatever holds the store’s access key. SOVRINT cannot say that these modules are FIPS 140 validated.

Protections on the site

• Pages cannot be framed, content types cannot be guessed, and the camera, microphone and location are switched off. A content security policy is sent in report-only mode, so it blocks nothing yet.
• The forms check every field, cap the size of a message, and limit each IP address to five sends in ten minutes, counted the same way as sign-in tries.
• Vercel’s platform mitigates denial-of-service traffic. SOVRINT has set no firewall rules of its own, and bot protection is off.

Changes and software

The code is in a private repository. A change reaches the live site when it is merged, and the same person writes and approves it. Nothing in the repository enforces a review. Vercel’s automated security review runs on each change, and that is the only regular security check. Dependencies are checked by hand. The last check, on November 7, 2026, showed one open high-severity advisory, in a package used by the storage library.

Logs and monitoring

Vercel keeps runtime logs for one day on SOVRINT’s plan, and they are not copied anywhere else. There is no intrusion detection, no alerting and no one on call, so a problem could go unnoticed for some time. New messages and orders wait in the owner’s Inbox, and no alert goes out yet.

Backups and recovery

A daily backup job to a separate private store went live on November 7, 2026. Two backups of live data were taken that day, started by hand, and one was restored into a separate store and checked against the original. The live store held only two small files and the first scheduled run has not happened yet, so this shows the method works and says little about recovery at real size. Nothing has been restored into the live service. Vercel states that it keeps backups for its own recovery, which customers cannot use.

When an account is deleted, its data leaves the live store at once and can stay in a backup for up to 30 days, as the Privacy Policy says. Issued invoices are kept, as that policy also says.

Being built

None of these can be relied on yet. Each moves up into the text above only once it runs in production and has been checked.

An outside audit or penetration test has no date.

Asking for more

If your office has a security questionnaire, send a note through Contact. SOVRINT will answer it in writing on the same terms as this page, including the weak answers. No reply time is promised. AI tools help handle form messages, so keep confidential material out of them.

If you have found a security problem, the Security Disclosure policy sets out the rules and the safe harbor. Keep the details out of the form.