Security at Akify

Last updated: November 4, 2026

Akify, Inc. is a Delaware corporation at 2737 Garber St, Apt #8, Berkeley, CA 94705. Enterprise customers and procurement teams use this page for our current security posture. For questionnaires, MSA/DPA requests, or additional evidence, contact security@akify.ai.

Compliance

Akify is undergoing a SOC 2 Type II examination with Ezzy Associates, an independent CPA firm. The examination covers the Security trust services category for the period September 20, 2026 through December 31, 2026. The engagement is in review: we are actively working through the examination. A written SOC 2 report is expected after the examination period closes. We have not completed certification and do not claim a finished SOC 2 report at this time.

Independent penetration testing

In October 2026, Parameter (Anytool, Inc.) conducted an authorized third-party penetration test using the Parameter AI Penetration Testing Agent under the oversight of the Parameter Security Research Team. Testing was informed by OWASP guidance (WSTG, Top 10, and relevant ASVS controls).

Authorized scope listed in the letter of attestation: akify.ai and cron-jobs-lime.vercel.app. The akify.ai scope covered Akify web properties under that domain, including the product at platform.akify.ai. cron-jobs-lime.vercel.app is Akify's production API and cron host (our rest-api deployment on Vercel).
Assessment activity beginning October 13, 2026; letter of attestation dated October 20, 2026.
Eleven findings reported (2 High, 4 Medium, 5 Informational). All eleven were remediated and verified by Parameter. There were no unresolved critical or high severity findings as of the letter date.
The letter is a point-in-time statement for the authorized scope; it does not certify that systems are vulnerability-free. Verification requests may be directed to Parameter at security@parameter.ai.

Download the letter of attestation (PDF).

Data and AI

We do not use customer Personal Data or connected workplace content to train our own foundation models, and we do not allow our AI service providers to use that content to train their models. Production generative AI runs on Google Vertex AI (Gemini) with zero data retention configured so prompts and outputs are not retained by Google beyond returning the response. Details are in our Privacy Policy.

Encryption

In transit: Customer and admin traffic to Akify applications and APIs is served over HTTPS / TLS. We do not offer a plaintext production web endpoint for the product.
At rest: Production data is hosted on cloud platforms that encrypt data at rest by default (including our primary database provider and Google Cloud Storage used for backups, with provider-managed encryption keys).
Application secrets: Sensitive credentials we store on behalf of customers (for example integration secrets and customer-provided database access tokens) are encrypted at the application layer using AES-256-GCM before persistence.

Infrastructure and subprocessors

Akify runs on major cloud providers in the United States, including Google Cloud Platform (infrastructure, Vertex AI, enterprise search, and GCS backups), Supabase (database and authentication), and Vercel (application hosting). Customer-connected tools such as Slack, GitHub, and Atlassian process data only when a customer enables those integrations. The current list is published on our Subprocessors page.

Backups and recovery

Production database data is backed up daily to encrypted off-site Google Cloud Storage (GCS), independent of the primary database provider (Supabase), with a rolling retention of at least 30 days. Our recovery objectives are a recovery point objective (RPO) of 24 hours or less and a recovery time objective (RTO) of 8 hours or less for a full logical restore. Restore testing is performed on a recurring cadence.

Sign-in and access

Customer workspaces are authenticated through our auth provider (Supabase), including passwordless magic link and, when enabled for an organization, Google or Microsoft sign-in. Application data is scoped by tenant. We apply security headers on our marketing site (including HSTS, frame denial, and related browser protections), and we run dependency and static analysis checks in CI. Enterprise agreements, including MSA and DPA terms, are available on request.

Incident response

Under our standard Data Processing Addendum, we notify affected customers of a security incident involving their personal data without undue delay and within 72 hours after becoming aware of it. Specific commitments in a signed agreement control for that customer.

Vulnerability disclosure

Report suspected security vulnerabilities to security@akify.ai. Our disclosure contact is also published at /.well-known/security.txt. Please do not publicly disclose issues until we have had a reasonable opportunity to investigate and remediate.

Evidence under NDA

Buyers may request our information-security policy set, a short summary of the Parameter findings and remediations, and a completed security questionnaire under NDA by emailing security@akify.ai.

Contact

Security questionnaires, Zip or procurement document requests, and evidence packages: security@akify.ai.