Trust Center
Security, privacy, and compliance at Decisions Lab.
Overview
Decisions Lab (Almita Limited) builds AI-powered simulation tools for understanding human behavior.
Core application data is hosted in Singapore. Application execution uses Vercel in Singapore and the United States. Authentication, payments, analytics, and AI are handled by the subprocessors listed below; some may process data outside Singapore.
Documents
Security Highlights
Encryption
TLS 1.3 in transit, AES-256 at rest. SMTP credentials encrypted in database.
Row-Level Security
Supabase RLS policies enforce strict user-based data access controls.
AI providers
Product AI uses OpenAI and AWS Bedrock with zero data retention.
PCI Compliance
Payment processing via Stripe. We never store card details.
Formal assessments
Decisions Lab does not currently have a completed SOC 2 report and is not yet formally in audit. Our roadmap targets SOC 2 Type I with an initial scope focused on Security criteria. Until then, we can share our security overview, subprocessors, data residency summary, and related diligence materials on request.
Subprocessors
Core providers support hosting, storage, authentication, payments, analytics, AI, and messaging. Connected mailbox flows (such as Gmail OAuth or your own email provider) depend on how you configure the product.
| Company | Purpose | Location |
|---|---|---|
 | Application hosting and execution | Singapore; United States |
 | Core database and storage | Singapore |
 | Authentication and user management | United States |
 | Payment processing | United States |
 | Product analytics and telemetry | United States |
 | Transactional email and notifications | United States |
 | AI feature processing | Vendor-managed |
 | AI and infrastructure (including Bedrock) | United States |
Have security questions?
Our team is here to help with any security or compliance inquiries.