Built for teams that have to defend their research.
Signals is designed so the most valuable thing in your workspace — the questions you ask, the sources you cite, the conclusions you draw — stays under your control.
This page summarizes the security posture of the Signals platform. For a vendor questionnaire, sub-processor list, or a draft DPA, contact signals@envisioning.io.
Identity and access
- SSO via WorkOS. All authenticated access is brokered by WorkOS AuthKit. Enterprise customers can connect their own identity provider (Okta, Entra ID, Google Workspace, and others) for SAML/OIDC SSO and SCIM directory sync.
- Role-based access. Workspace membership is scoped per organization, with admin, editor, viewer, and guest roles. Editors and admins consume paid seats; viewers and guests are free and read-only.
- Least privilege. Backend functions enforce membership and role checks before reading or mutating workspace data. There is no shared database surface across organizations.
- Session management. Sessions are short-lived and revocable through your IdP.
Data protection
- In transit. All traffic is served over TLS. Internal calls between Signals, Convex, and AI providers are encrypted in transit.
- At rest.Workspace data is stored in Convex’s managed infrastructure with encryption at rest. Object storage uses provider-managed encryption keys.
- Isolation.Each customer organization is a first-class tenant boundary in the data model. Access checks reference the caller’s membership and role on every request.
- Backups. Convex performs continuous backups with point-in-time recovery. Workspace data can be exported on request.
BYO-AI: your prompts go to your provider, not us
Signals orchestrates third-party AI models — it does not train its own. We route prompts and workspace context to the model your workflow specifies. Where supported, those calls are billed to your provider accounts directly, and the data handling terms are governed by your contract with that provider, not by us.
- No training on your data. We do not use customer prompts, outputs, or workspace content to train models.
- Provider choice. Workspace admins can restrict which models are available to their users via the model catalog.
- Auditability. Each generation is recorded against a workflow run with the model, prompt, sources, and outputs preserved for review.
Sub-processors
We rely on a short list of infrastructure providers to operate Signals. Material changes are announced before they take effect for paid plans.
| Provider | Role | Notes |
|---|---|---|
| WorkOS | Identity & access | SSO, directory sync, and session management. SOC 2 Type II. |
| Convex | Application database & functions | Authenticated reads/writes with row-level access enforced in code. SOC 2 Type II. |
| Vercel | Hosting & edge delivery | TLS termination, DDoS mitigation, and global delivery. SOC 2 Type II. |
| Vercel AI Gateway | AI model routing | Routes prompts to upstream providers (OpenAI, Anthropic, Google). Configurable per workspace. |
Compliance and assurance
- Sub-processor certifications. Our primary infrastructure providers (WorkOS, Convex, Vercel) maintain SOC 2 Type II reports. We can share their reports under NDA.
- Envisioning’s posture. Signals itself is not yet SOC 2 certified. We are operating to SOC 2 aligned controls and can walk enterprise prospects through our current readiness on request.
- GDPR / UK GDPR. We support data subject access, correction, and deletion requests as described in our privacy policy. A data processing addendum is available on request.
Vulnerability disclosure
If you believe you’ve found a security issue, please report it to signals@envisioning.io. We acknowledge reports within two business days. Please do not publicly disclose issues until we’ve had a chance to respond. We do not currently operate a paid bug bounty, but we credit reporters who request it.
Contact
Security, compliance, or procurement questions go to signals@envisioning.io. We’ll route you to the right person at Envisioning.