Security
How we handle your data.
Facts only: what's in place today, and what isn't yet. For legal terms, see the privacy policy, DPA and sub-processor list.
Human approval before publishing
Nothing publishes until someone with permission approves it.
Drafts wait in a review queue. Posts publish only after that approval.
What's in place today
SOC 2 / ISO 27001 certification: no, not today.
Organization-scoped access
Every request is scoped to your organization and checked against the user's role.
Editors submit for review. Approving needs the approve permission.
Review links
Client review links use random tokens, stored hashed.
Links can be revoked or expire, and review actions are rate limited.
Payments
Payments are handled by Stripe.
Solvgent doesn't store card numbers.
Hosting
The app and its database run on servers in Germany (Hetzner).
The website is served through Cloudflare. All providers are on our sub-processor page.
Drafting providers
Drafts come from third-party AI providers listed on our sub-processor page.
They receive the brand context and brief needed to write a draft.
Responsible disclosure
Found a vulnerability?
Email security [at] solvgent [dot] com. Our contact details are also published at /.well-known/security.txt.
- 1Tell us what you found.
The affected URL or feature, steps to reproduce, and what an attacker could do.
- 2Test only your own accounts.
Don't access other customers' data, don't degrade the service, and don't use social engineering or spam.
- 3Give us time to fix it.
Please keep the details private until we've had a reasonable chance to fix the issue. We'll confirm we received your report.
This page was last reviewed on October 24, 2026.
Is Solvgent SOC 2 or ISO 27001 certified?
No, not today. We'll say so here when that changes, with dates.
Where is my data stored?
Application data, including the database, is stored on servers in Germany. Some providers, such as Stripe and our AI providers, process data in the United States. See the sub-processor page for the full list.
Do you sell personal information?
No. We don't sell personal information or share it for cross-context behavioral advertising. Our website loads no ad pixels or analytics.
Can you sign our DPA or security questionnaire?
Our US Data Processing Addendum is published. For questionnaires, email security@solvgent.com.
How do I report a vulnerability?
Email security@solvgent.com with the details and steps to reproduce. Please don't access other customers' data or disrupt the service while testing.