Security
Security & Data Protection
Effective 5 July 2026 · Contact: louisgeoffrion@alunio.ai
This page is written to be handed to your compliance partner. It describes what is true of Alunio today. Where something does not yet exist, this page says so.
Where your data lives
All application data is stored in Supabase, a managed PostgreSQL platform, hosted on AWS in Ireland, inside the EU. Data is encrypted in transit over TLS and encrypted at rest. Nothing is stored on laptops, spreadsheets, or personal drives.
Tenant isolation
Every customer table is protected by PostgreSQL row level security, enforced by the database itself on every query. One agency can never read another agency's deals. It is a rule the database applies before any row is returned, out of reach of application bugs.
Who can access it
Your agency's own named users, and the founder for support. That is the complete list. Alunio has no support team, no offshore contractors, and no analysts with production access. Today, staff access means one person: Louis-François Geoffrion. I would rather tell you that plainly than dress it up.
Controller and processor
Under UK GDPR, your agency remains the controllerof your clients' personal data. Alunio acts as your processor: Alunio processes that data only on your documented instructions, for deal progression risk scoring and assisted chasing, and for nothing else. This is set out in the Data Processing Agreement, offered for review before you sign anything.
Sub processors
Alunio uses a small, fixed set of infrastructure providers. This is the complete list. Alunio gives notice before adding or replacing any of them.
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Supabase | Database and authentication | EU (Ireland) |
| Vercel | Application hosting | US · UK IDTA / Standard Contractual Clauses |
| Anthropic | AI chase drafting, only when a draft is requested. Does not train on client data. | US · Standard Contractual Clauses |
| Resend | Service emails, when enabled | US · Standard Contractual Clauses |
| PostHog | Product analytics, only after explicit cookie consent | EU / US · Standard Contractual Clauses |
What Alunio does not hold
Alunio processes transaction progress data: deal stages, dates, party names, and business contact details. It deliberately does not hold the sensitive material that sits elsewhere in your stack:
- No AML records;
- No ID documents;
- No client bank details;
- No mortgage applications.
If Alunio were ever breached, that is the difference between an incident and a catastrophe.
The same discipline applies to email intake. Where an agency routes team mail to Alunio, any message that is not matched or assigned to a deal is permanently deleted within 24 hours, raw payload included. Only deal correspondence is kept.
If Alunio ever shuts down
The question every young vendor should answer and rarely does. If Alunio ceases operating, you get 30 days notice, a full export of your data handed over in a standard format, and then verified deletion. The same applies on contract exit: your data is returned or deleted, at your choice. Your deal book is yours.
What Alunio does not claim
Alunio Ltd is in formation and Alunio is a young product. It does not yet hold ISO 27001, SOC 2, or an independent penetration test report, and no badge goes on this page until it does. If a claim is not on this page, do not assume it; ask at louisgeoffrion@alunio.ai and you will get a straight answer.
The paperwork
The UK GDPR Article 28 Data Processing Agreement is published in full, before signature, so your compliance partner can review it with nothing hidden. The website Privacy Policy and Cookie Policy are published alongside it.