Trust + commitments · 2026-08-26

Where Refolded stores your memory, and what we promise about it.

GDPR posture, SOC-2 roadmap, and data residency — three questions a B2B procurement team asks before signing a DPA. Answers below are copy-pasteable into a security questionnaire.

See pricing →Capture a memory →

1 — GDPR posture

Lawful basis, recording-consent, and the data-subject path.

Three questions a buyer asks before signing a DPA — which legal basis each piece of work sits on, whether the platform records audio or video, and how a data-subject request is processed. The answers below are written to survive a CISO's read-through.

Lawful basis

GDPR Art. 6, per processing purpose.

  • Core memory loop — /memories, /draft, /experiments — Contract — Art. 6(1)(b)

    The basis a paying workspace engages Refolded under. Performance of the service the user signed up for.

  • Service-improvement analytics — Legitimate interest — Art. 6(1)(f)

    Aggregated, workspace-scoped usage signals that inform roadmap. No cross-workspace profiling, no ad-targeting.

  • Marketing email (waitlist + product updates) — Consent — Art. 6(1)(a)

    Double opt-in via POST /api/waitlist-confirm-email; every send cites the same token the original signup stored.

  • Tax / invoice records (Stripe-issued receipts) — Legal obligation — Art. 6(1)(c)

    Held in our books for the statutory retention window; not used for product analytics.

Recording consent

No meeting recorder, today — by capability, not policy.

Refolded ships no meeting recorder, no microphone capture, and no note-recording surface today. This is a capability posture, not a soft promise: the microphone flag in appCapabilities (next.user-config.ts) is false. The browser cannot prompt for getUserMedia, and the API is unreachable from this origin.

Future-state: when a recorder ships, consent UX ships before the capture path. No silent-mic mode, no record-by-default, and the consent token is bound to the capture session — not the account.

Data-subject path

Export or delete on refolded@polsia.app.

One inbox handles DSARs, DPA asks, and security-questionnaire follow-ups. The same address is wired into the footer Contact link, so a buyer emailing a sales question and a buyer emailing a DSAR reach the same human.

  • Export: a machine-readable archive of memory entries, drafts, experiments, and auth metadata — within 30 days of a verified request.
  • Deletion: every row tied to the account (memory entries, drafts, experiments, waitlist signup, billing rows addressed to the workspace) purged within 30 days.
  • Identity verification: matched against the auth email on file; if that email no longer reaches the requester, a signed proof-of-account letter is required.

2 — SOC-2 roadmap

Our trust-program roadmap.

Honest framing: Refolded is not SOC-2 certified today. The roadmap below names the controls in place, the controls in flight, and the calendar window for each — with a per-row status a future editor can flip without rewriting the page.

Roadmap — not a current certification

Status today

What is already in place, in plain prose.
  • Single-region managed Postgres for the primary database.
    Done
    · In place today

    Production runs on a managed provider with TLS-only ingress and a least-privilege DB user per app. No string-literal secrets in the build — every secret is injected through the Polsia env-var layer.

  • 1-day Postgres backup window.
    Done
    · In place today

    Point-in-time recovery over the last 24 hours; daily snapshot retained for 30 days.

  • No customer-provided keys for AI, email, or payments.
    Done
    · In place today

    The ai, email, and stripe-billing modules all route through the Polsia proxy pattern. The repo carries no OpenAI / Sendgrid / Resend / Stripe key — the vendor credential never lives in this code.

  • One engineer with prod-DB access today.
    In progress
    · Quarter-by-quarter

    Access is via short-lived credentials issued on the Polsia platform, not a shared root password, and every read is logged. The access list widens as the trust-program slack-control workshops land.

Target window

What ships, in order, and when.
  • Controls inventory + gap analysis
    Planned
    · EOY 2026

    Map every SOC-2 Trust Services Criterion to a control owner, a test plan, and a deterrent failure mode. Output: a single source of truth the auditor reads without folklore.

  • SOC-2 Type I observation window
    Planned
    · EOY 2026 / early 2027

    Auditor attests that controls were designed and in place at a point in time. Becomes the externally verified baseline that any security questionnaire cites.

  • Continuous control monitoring
    Planned
    · Q1–Q2 2027

    Identity, change-management, and backup tests run weekly and feed a public status page. Buyer-facing evidence, not internal-only dashboards.

  • SOC-2 Type II report
    Planned
    · End of 2027

    Auditor attests that the same controls operated effectively over the observation window. This is the report a B2B procurement team asks for on a recurring annual basis.

Type II SOC-2 is the externally verified report a B2B procurement team asks for on a recurring annual basis. Until that report exists, this page is the canonical source — not a certification badge.

3 — Data residency

Where your memory and metadata live today.

Primary database, payment slice, email transactional slice, AI slice — named region per slice, and the next two regions Refolded will add as named near-term betas, not painted-on dates.

Today — single Postgres / Prisma

United States — primary

Single Polsia-managed Postgres region (US)

Memory entries, drafts, experiment ledgers, auth rows, waitlist signups, and the pricing-tier catalog all live in one Polsia-managed Postgres. Stripe holds no card data — the checkout flow ships a hosted-checkout redirect (the stripe-billing module reads `redirectUrl` and `window.location.assign`s it), so card PAN never touches the Refolded origin. Email transactional flow routes through the Polsia email proxy (no vendor key in this repo). AI writes go through the Polsia AI proxy (no OpenAI key in this repo).

Near-term beta

European Union — near-term beta

Frankfurt or Stockholm

Targeted within 12 months. A workspace can request to be pinned to the EU region before the enterprise plan lands in production, provided the operator is willing to be a named reference. Database, auth records, and the waitlist signup all move to the EU instance.

Near-term beta

United States — near-term beta

Virginia

Targeted within 12 months as a US-region alternative for US-pinned workspaces that need a closer data plane. Same control set as the EU beta; same data-subject export / deletion path.

Near-term beta

Per-workspace region pinning

SLA-tier feature

Region pinning as a built-in feature once enterprise plans land. Gated on enterprise-plan volume — the SLA tier carries the multi-region operational margin a pinned region needs.

Region pinning ships as a built-in SLA-tier feature once enterprise plans land — gated on enterprise-plan volume. Refolded does not promise an exact ship date for either near-term region; the language above is “targeted within 12 months”, not “shipping on”.

Procurement

Need a DPA, a SOC-2 readiness summary, or a questionnaire filled in?

One inbox

Email refolded@polsia.app — same inbox as the footer Contact link, no new form. Tell us what you need signed and the timeline you need it on.

See pricing →