Is my data isolated from other customers?

Yes. ASHR.work is a multi-tenant platform with a tenant_id on every per-org table and a Postgres row-level-security policy that makes cross-tenant reads or writes impossible — even with a hand-crafted query.

All data is encrypted at rest and in transit using modern industry-standard cryptography (AES-256 at rest, TLS in transit) provided by the underlying Supabase platform. Database backups are encrypted.

Are you GDPR / DPDP / CCPA compliant?

ASHR.work is designed to support GDPR, India's DPDP Act, and CCPA subject-rights workflows (access, export, erasure). A standard, signed Data Processing Agreement is not yet published — email hello@ashr.work to discuss data-processing terms as part of your contract.

Who can see my data inside ASHR.work?

Only users in your tenant. Within a tenant, RLS plus role gates mean employees see their own data, managers see their direct reports, admins see everything in the tenant. ASHR.work employees do not access customer data except for explicit support requests with customer consent.

Where is data stored?

On Supabase (Postgres, Auth and Storage), hosted on AWS in Mumbai, India (ap-south-1). That is the one region every tenant runs in today — there is no per-customer or per-plan choice of hosting region yet.

Do you have SOC 2 / ISO 27001?

No. ASHR.work does not currently hold SOC 2, ISO 27001, or any other independent compliance certification. In place of a certificate, we answer vendor security questionnaires directly — email hello@ashr.work.

How do you handle data deletion?

Individual subject-deletion requests are processed promptly per applicable law (e.g. GDPR Article 17). For a whole workspace leaving ASHR.work, the data is kept intact for a 30-day window after suspension before it becomes eligible for deletion — ask hello@ashr.work for the specifics of your account.

Is my data safe in ASHR.work? How do you handle security and compliance?

Quick answer

Yes. Every customer's data lives in a dedicated tenant with a tenant_id column on every per-org table, protected by Postgres row-level-security. Data is encrypted at rest and in transit using the Supabase platform's modern cryptography. ASHR.work is designed to support GDPR, DPDP (India), and CCPA subject-rights workflows.

How isolation works

Every per-org table has a tenant_id column and a restrictive RLS policy: tenant_id = current_tenant_id(). The tenant is derived from the authenticated user's session — not from the URL — so there is no way to accidentally or maliciously read or write another tenant's rows.

Even a SQL injection, a misrouted API call, or a logic bug in application code cannot cross the tenant boundary, because Postgres enforces isolation before the row is ever returned.

Where is my data hosted?

ASHR.work runs on Supabase, hosted on AWS in Mumbai, India (ap-south-1). That is the only region in use today — every tenant's database lives there, and there is currently no option to choose a different region for your workspace. If regional hosting outside India becomes something you need, talk to us; it is not something we offer yet.

What about backups, exports, and deletion?

Backups — Supabase, our database provider, takes automated encrypted backups as part of its hosted Postgres service. We have not published a specific numeric retention window for those backups, and don't yet have a published, independently tested disaster-recovery runbook. If backup specifics matter for your contract, ask hello@ashr.work for the current details rather than assuming a number.
Exports — admins can export data from Reports and Documents inside the product. For a full tenant export, contact support and we will produce one.
Deletion — when a workspace leaves ASHR.work, it is suspended first and kept whole for 30 days before it becomes eligible for deletion — nothing is touched during that window, and the workspace can be restored as-is. After that window, deletion is a manual, audited action, never an automatic sweep.
Subject requests — GDPR Article 15 (access) and 17 (erasure) are processed promptly on request to hello@ashr.work.

Where can I read more?

See the full security page for the rest of our security posture. We don't have a downloadable questionnaire yet — email hello@ashr.work and we'll fill out yours directly.

Frequently asked questions

Is my data isolated from other customers?: Yes. ASHR.work is a multi-tenant platform with a tenant_id on every per-org table and a Postgres row-level-security policy that makes cross-tenant reads or writes impossible — even with a hand-crafted query.
Is data encrypted?: All data is encrypted at rest and in transit using modern industry-standard cryptography (AES-256 at rest, TLS in transit) provided by the underlying Supabase platform. Database backups are encrypted.
Are you GDPR / DPDP / CCPA compliant?: ASHR.work is designed to support GDPR, India's DPDP Act, and CCPA subject-rights workflows (access, export, erasure). A standard, signed Data Processing Agreement is not yet published — email hello@ashr.work to discuss data-processing terms as part of your contract.
Who can see my data inside ASHR.work?: Only users in your tenant. Within a tenant, RLS plus role gates mean employees see their own data, managers see their direct reports, admins see everything in the tenant. ASHR.work employees do not access customer data except for explicit support requests with customer consent.
Where is data stored?: On Supabase (Postgres, Auth and Storage), hosted on AWS in Mumbai, India (ap-south-1). That is the one region every tenant runs in today — there is no per-customer or per-plan choice of hosting region yet.
Do you have SOC 2 / ISO 27001?: No. ASHR.work does not currently hold SOC 2, ISO 27001, or any other independent compliance certification. In place of a certificate, we answer vendor security questionnaires directly — email hello@ashr.work.
How do you handle data deletion?: Individual subject-deletion requests are processed promptly per applicable law (e.g. GDPR Article 17). For a whole workspace leaving ASHR.work, the data is kept intact for a 30-day window after suspension before it becomes eligible for deletion — ask hello@ashr.work for the specifics of your account.

How much does ASHR.work cost and what is included?
ASHR.work is priced in INR for India — Starter, Growth and Complete, per employee per month, ex-GST — with a 15-day free trial and Enterprise for larger teams.