CapsuLabs: Environmental Intelligence

Security & Trust

How CapsuLabs protects your data: what we have committed to publicly

Privacy frameworks

GDPR-aligned · Israeli Privacy Protection Law · EU AI Act non-high-risk classification

Hosting

Supabase EU (Frankfurt) primary · Cloudflare edge · TLS in transit · encryption at rest

Documents

Privacy Policy · Terms · DPA · AI Transparency · Acceptable Use · Sub-processor list

1. What is in force today

  • GDPR (EU 2016/679) alignment, see the published Data Processing Agreement for the Art. 28 controller / processor terms, sub-processor disclosure, breach-notification SLA, and data-subject-rights workflow.
  • Israeli Privacy Protection Law (5741-1981) and Regulations 2017 alignment, captured in the Privacy Policy.
  • EU AI Act (Reg. 2024/1689): CapsuleAI is classified as a non-high-risk system; rationale and risk-management documentation in the AI Transparency Policy.
  • Sub-processor inventory with 30-day advance-notice mechanic, see the dedicated Sub-processors page.
  • Encryption in transit via TLS for the public application; database and storage are encrypted at rest by the underlying Supabase platform.
  • Breach notification commitments published in the DPA (B2B controllers) and Privacy Policy (data subjects).

2. Procurement & security review

Detailed security-control descriptions, vendor-questionnaire responses (SIG, CAIQ, bespoke), and any further due-diligence documentation are shared one-on-one with prospective B2B customers under a mutual non-disclosure agreement. We do this because:

  • Posting concrete operational controls publicly creates a recipe for adversaries.
  • We will only commit in writing to controls we are confident we operate today, and several programmes are under active build-out.
  • Vendor questionnaires are tailored to your data-classification tier; a generic public answer wastes everyone's time.

To request a security review, email legal@capsulabs.co.il with your organisation's standard NDA template and questionnaire. We typically return a complete response within 10–15 business days.

3. Coordinated vulnerability disclosure

Researchers may report security findings to legal@capsulabs.co.il with the subject line "Security — vulnerability disclosure". We will:

  • Acknowledge receipt within 5 business days;
  • Triage and confirm severity within a further 10 business days;
  • Respect a good-faith embargo; we will not pursue legal action against researchers who follow this policy and act on capsulabs.co.il / capsulabs.io properties owned by us, without DoS/volumetric tests, social engineering, or physical attacks.

4. What we have NOT publicly committed to

In the interest of not over-promising, the following are not currently publicly committed by CapsuLabs. Where any of these are required by an enterprise customer, the commitment is captured in the executed Order Form & Partnership Liability Addendum, not on this page:

  • SOC 2 Type I / Type II audit attestation;
  • ISO 27001 certification;
  • Specific uptime guarantees (99.5%, 99.9%, etc.), see the SLA page;
  • Specific E&O / cyber-liability insurance limits in dollar terms;
  • Public RPO / RTO, pen-test cadence, or dependency-scanning SLAs.

When any of these become public commitments (through signed audit engagements, bound insurance policies, or product attestations), they will be added to §1 above with the supporting evidence.

5. Contact

Last reviewed: [date pending]. This page is intentionally conservative: only commitments substantiated by published documents or executed contracts appear here.

Cookies on this site

We store only what the site needs to work: keeping you signed in, remembering your language, and checking you're not a bot. We also run Google's advertising tag on every page, to tell which ads bring people here. Until you allow it, that tag stores nothing on your device and sends Google only a basic, cookie-free signal. Allowing all lets it use cookies too. Cookie Policy · Privacy Policy