How data is actually handled
No certifications to point to yet, and this page won't pretend otherwise. What follows is factual — what the infrastructure actually does today, and where the honest gaps are against what an enterprise deployment would eventually need.
The application is served by Vercel over HTTPS. Data is stored in a Supabase-managed PostgreSQL database in the Southeast Asia (Singapore) region, encrypted at rest and in transit by the platform's default configuration.
Sign-in to the authenticated product (AI Estate, Agent Passports, Approvals) uses Google OAuth via Supabase Auth. No passwords are set, stored, or handled by Named Principal's own infrastructure — that's delegated entirely to Google.
Report and pilot-enquiry emails are sent through Resend. Message content passes through their infrastructure in transit to deliver the email; it isn't stored by Named Principal beyond what's disclosed in the privacy notice.
Authenticated client requests are restricted through row-level security policies scoped to the user's organisation. Privileged server-side credentials — used for lead-capture tables like assessment reports and pilot enquiries — are never exposed to the browser and are limited to controlled server routes.
Every material action inside the authenticated product — a Passport created, a control status changed, an approval decision made — is written to an append-only audit log tied to the acting user and organisation.
An Agent Passport cannot reach Approved status without a named human principal and a scheduled review date. This is enforced as a database constraint, not just a form validation — it holds even if a future code change forgets to check it.
An honest maturity check against what an enterprise deployment eventually needs:
If you find a vulnerability, email reports@namedprincipal.com directly with what you found and how to reproduce it. There's no bug bounty program yet, but every report gets read, and a genuine finding gets fixed and credited if you'd like.
© 2026 Aseem Mohan · Assessment · Privacy notice · Methodology