ServeSpeak is not currently independently certified to ISO 27001 or audited under SOC 2. We do not present our providers’ certifications as our own.
Our safeguards
- Encrypted HTTPS connections for the website, app and service APIs.
- Supabase authentication and row-level database rules that restrict students to their own records.
- Server-side storage of Stripe and OpenAI secret keys; secret keys are not shipped to student browsers.
- Signed Stripe webhooks and server-side subscription verification.
- Origin checks, authenticated AI endpoints, restricted inputs and non-public diagnostic records.
- Minimal collection: payment-card details are handled by Stripe, not stored by ServeSpeak.
- Routine software updates, access review, backups and incident investigation.
Independent provider assurance
Supabase states that it is SOC 2 Type 2 compliant and ISO 27001 certified. OpenAI states that its API services have undergone SOC 2 Type 2 examination and that relevant information-security systems maintain ISO certifications. Stripe states that its controls are regularly audited under SOC programmes and it operates payment-security controls. These assurances cover the providers’ services—not ServeSpeak as an organisation.
Shared responsibility
No online service can promise absolute security. ServeSpeak is responsible for configuring its application safely; our providers are responsible for their underlying infrastructure. Students should use a unique password, keep devices updated and never share sign-in or payment codes.
Report a security concern
Please report suspected vulnerabilities or account-security issues privately to hello@serve-speak.com. Do not access, alter or download another person’s data. We will acknowledge genuine reports and investigate them promptly.
Incident response
We assess suspected incidents, contain access where possible, preserve relevant evidence, restore safe operation and notify affected people and regulators when applicable law requires it.