Security
Security at Mandate
Your policy priorities, watch lists and campaign plans are sensitive. Here is how we protect them.
Last updated October 20, 2026
Built on audited infrastructure
Mandate runs on providers that hold their own SOC 2 Type 2 reports, with payments handled by a PCI DSS Level 1 processor.
Your data stays yours
Each organization's workspace is isolated at the database layer, encrypted in transit and at rest, and yours to export or delete.
Never used to train AI
We do not train AI models on your data, and our AI provider does not train on what we send it through its commercial API.
Infrastructure
Mandate is hosted on Vercel, and our database and account sign-in run on Supabase. Both providers maintain SOC 2 Type 2 reports covering their physical security, network protection, monitoring and availability. We do not run our own servers or data centers.
Data protection
- Encryption in transit. All traffic to Mandate is served over HTTPS.
- Encryption at rest. Workspace data is encrypted at rest by our database provider.
- Organization isolation. Database row level security limits every organization's bills, assessments, notes and campaigns to its own members, enforced in the database itself rather than only in application code.
- Your control. You can export your work at any time and ask us to delete your organization's data by emailing hello@mandatepolicy.com.
Access control
- Passwords are handled by our authentication provider and stored only as secure hashes, never in plain text. You can also sign in with a one-time email link.
- Internal administrative tools are limited to Mandate platform administrators, and every administrative change to a customer account is recorded in an audit log.
- Service credentials live only on the server, never in the browser, and each is scoped to the minimum access it needs.
Application security
- Every code change runs automated linting, type checking, tests and a production build.
- Scheduled jobs only run when called with a secret credential or a signed, single-use request.
- Payment notifications from Stripe are accepted only with a verified signature.
- Error messages shown to users are written to avoid exposing internal details.
AI and your data
Mandate uses Claude, from Anthropic, to read bills against your organization's profile and to draft impact assessments and campaign language. We send Anthropic only what each task needs: your organization profile and the legislation being assessed. Anthropic does not use inputs or outputs from its commercial API to train its models by default, and Mandate does not train AI models on your data. AI output is a first read, not legal advice, and we label it that way throughout the product.
Payments
Checkout and billing management are handled by Stripe, a PCI DSS Level 1 service provider. Your card number goes directly to Stripe and never touches Mandate's servers.
Subprocessors
These are the service providers that process data on our behalf.
| Provider | Purpose | Data involved | Assurance |
|---|---|---|---|
| Vercel | Website and application hosting | Requests to the Mandate site and app | SOC 2 Type 2 |
| Supabase | Database and account sign-in | Account, organization and workspace data | SOC 2 Type 2 |
| Anthropic | AI impact analysis and drafting | Your organization profile and the bills being assessed | No training on commercial API data by default |
| Stripe | Subscription billing | Billing contact and payment details | PCI DSS Level 1 |
| Resend | Email delivery for alerts and briefs | Your email address and the content of each email | SOC 2 Type 2 |
| Cloudflare | Storage of public legislative documents | Public bill text and government records only | No customer data stored |
We collect legislation from public sources such as Congress.gov, the Federal Register, Open States and LegiScan. None of your data is sent to them.
Compliance
Mandate is an early-stage company and has not yet completed its own SOC 2 audit. We rely on the audited controls of the providers above and follow the practices on this page. If your organization needs a security questionnaire completed or more detail for a procurement review, email hello@mandatepolicy.com and we will work with you. For accessibility, see our Accessibility Statement.
Availability
Live status for the web application, legislative data collection, alerts and AI briefings is on our status page.
Responsible disclosure
If you believe you have found a security vulnerability in Mandate, please email hello@mandatepolicy.com with the subject line “Security” and enough detail for us to reproduce it. Please give us reasonable time to fix the issue before sharing it publicly, and do not access, change or delete other customers' data while testing. We will acknowledge your report, keep you updated, and will not pursue legal action against good-faith research that follows these guidelines.
Contact
Questions about security or privacy can go to hello@mandatepolicy.com. Our Privacy Policy explains how we collect and use personal information.