Shared responsibility
What Sovaria secures, what you secure, and how to use Sovaria to meet your own SOC 2, DPDP Act, GDPR, HIPAA and PCI obligations.
Sovaria secures the platform: the servers, the network, the services, backups, and the isolation between customers. You secure what you build on it: who can read and change your data, your keys, your users' accounts, and your own legal duties to the people in your app. Using Sovaria doesn't make your product compliant by itself, but it gives you building blocks and evidence for most of the work.
#Who does what
| Area | Sovaria | You |
|---|---|---|
| Infrastructure | Hosting in AWS Mumbai, patching, firewalls, monitoring, capacity. | — |
| Isolation | Separate database per project; tenant from the session or key; sandboxed functions. | — |
| Access to your data | Default-deny policies and row-level security, enforced on every request. | Write the access policies and Row-level security and access for every table and bucket; check them with Security advisor. |
| Keys | Encrypted storage; scoped and revocable API keys. | Keep the service role key on servers only (Keys, tokens and credentials); rotate keys when people leave. |
| Your team | MFA, passkeys, SAML SSO, SCIM, session timeouts. | Turn on MFA, require it for your organization, and review members and keys every quarter (Organizations, members and roles). |
| Your app users | Sign-in, MFA, account deletion and admin tools. | Decide how your users sign in; answer their privacy requests (Admin API (auth.admin), Let your app's admins manage users (auth.users)). |
| Encryption | TLS everywhere; encrypted backups and secrets. | Use your own key where your rules ask for it. |
| Backups | Daily encrypted backups and point-in-time recovery (Backups and recovery). | Choose a plan whose recovery window fits your needs; export your own copies if your rules require it. |
| Logs | A tamper-evident audit log per organization; staff access recorded in it. | Review and export it for your audits (Audit log). |
| Incidents | Tell you about a breach of your data without undue delay, aiming for 24 hours (DPA). | Notify your own users and regulators where you are the data fiduciary or controller. |
| Code you write | Run it in a sandbox. | Keep functions, dependencies and secrets in your own code secure. |
#Your SOC 2 or ISO 27001 audit
- Treat Sovaria as a vendor (a subservice organization). Sovaria has no SOC 2 report yet, so your auditor will look at our Security questionnaire answers, the trust center and our policies under NDA instead.
- Download the evidence pack for your organization: audit-log verification, encryption and backups per project, access matrix and Security Advisor findings, with SHA-256s so your auditor can check nothing was edited.
- Export the audit log for the audit period (
sov compliance audit-log), including Sovaria staff access (--staff-access-only). - Your controls on our side are the list in "Who does what": access policies, MFA, key handling, quarterly reviews. Record them in your own control set.
#The DPDP Act (India) and the GDPR
- For the people who use your app, you are the data fiduciary (the one who decides why and how personal data is used; the controller under the GDPR) and Sovaria is your processor under the DPA. You need your own privacy notice and lawful basis or consent for what you collect.
- Data stays in India (AWS Mumbai) unless you use AI features, which send prompts to the providers listed on the subprocessor page.
- Answer your users' requests with the platform: find, correct, export and delete their data through the console, API or SDKs; deleting an app user also removes them from your project database.
- If your app collects analytics, record consent with Product analytics (
setEnabled(false)drops a user's events everywhere). - Children: if your app is used by people under 18 in India, the DPDP Act requires verifiable parental consent before you process their data. That consent flow is yours to build.
- Breaches: we tell you without undue delay; you notify the Data Protection Board within 72 hours and the people affected.
#HIPAA
Health data covered by HIPAA needs the Enterprise plan with the HIPAA add-on and a signed BAA. We can't sign a BAA for protected health information yet, because we haven't accepted the AWS BAA; ask us for the current state before you plan a launch. Then turn on HIPAA mode, mark projects that hold PHI, and download the HIPAA safeguards report before go-live (HIPAA mode and PHI projects). Your own risk analysis, policies and training remain yours.
#Payments (PCI DSS)
Never store card numbers in Sovaria. Use a payment provider's hosted checkout and keep only its payment references; that keeps your app out of most PCI DSS scope.