Security

Security Overview

PrimusReview is built for the pharmaceutical industry, where data security and regulatory compliance are non-negotiable. This page summarises the technical and organisational security controls we have in place. For detailed documentation, contact us at thompson.daniel@primusreview.com.

Infrastructure and hosting

Hosting providerVercel (Edge Network) — SOC 2 Type II certified

DatabaseSupabase — SOC 2 Type II certified, hosted on AWS eu-west-2 (London)

Data residencyPrimary data stored in UK/EU region (AWS eu-west-2)

CDNVercel Edge Network with global distribution

Encryption

Encryption in transitTLS 1.2 and TLS 1.3 enforced across all connections. HTTP traffic automatically redirected to HTTPS.

Encryption at restAll database data encrypted at rest using AES-256 via Supabase/AWS RDS encryption.

Password storagePasswords hashed using bcrypt via Supabase Auth. Plaintext passwords are never stored.

API keysAll API keys and secrets stored as environment variables, never committed to source code.

Access controls

Row-level security (RLS)Supabase RLS policies enforce that users can only access their own data. No cross-user data access is possible at the database level.

AuthenticationSupabase Auth with email confirmation required. Sessions managed via secure httpOnly cookies.

Admin accessAdministrative database access restricted to service role key, used only server-side in authenticated API routes.

Rate limitingAPI endpoints protected by rate limiting via Upstash Redis. Auth endpoints limited to prevent brute force attacks.

Application security

Content Security PolicyStrict CSP headers configured to prevent XSS and injection attacks.

Security headersX-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS headers enforced on all responses.

CAPTCHACloudflare Turnstile CAPTCHA on signup to prevent automated account creation.

Input validationAll user inputs validated server-side before processing.

Dependency managementDependencies regularly updated to address known vulnerabilities.

AI processing

AI providerAnthropic API (Claude). Document content is transmitted to Anthropic for processing.

Transcription providerAssemblyAI. Used exclusively for the Video Review feature — uploaded audio/video is transcribed with timestamps before compliance review.

Training dataAnthropic and AssemblyAI do not use API inputs to train models by default. User documents and audio/video content are not used for model training.

Data retention by AnthropicAnthropic retains API inputs for a limited period for trust and safety purposes only. See anthropic.com/privacy for details.

Prompt securitySystem prompts are server-side only and never exposed to the client. Prompt version is logged with each review.

Monitoring and incident response

Error monitoringSentry error monitoring active in production. All exceptions are captured and alerted.

Uptime monitoringUptimeRobot monitors primusreview.com every 5 minutes with alerting on downtime.

Anthropic API limitsMonthly spend limits and alerting configured to prevent runaway API costs.

Incident responseIn the event of a security incident, affected users will be notified within 72 hours in accordance with UK GDPR requirements.

Data handling

Data minimisationOnly data necessary to provide the service is collected and retained.

Data retentionReview data retained for the duration of the account. Deleted within 30 days of account closure. See our Data Retention Policy for full details.

Sub-processorsA full list of sub-processors is available at primusreview.com/sub-processors.

Data Processing AgreementA DPA compliant with GDPR Article 28 is available on request. Contact thompson.daniel@primusreview.com.

Compliance and certifications

UK GDPRPrimusReview operates in compliance with the UK General Data Protection Regulation and the Data Protection Act 2018.

ICO registrationRegistered with the Information Commissioner's Office as a data controller.

Vercel SOC 2Available at vercel.com/security

Supabase SOC 2Available at supabase.com/security

Anthropic securityAvailable at anthropic.com/security

Stripe PCI DSSStripe is PCI DSS Level 1 certified. Card data is never processed or stored by PrimusReview.

Security questions or concerns?

If you have specific security requirements, need additional documentation for a vendor assessment, or wish to report a security concern, please contact us directly.