Trust Center
Your sources are your business. Here is how we keep them that way.
Sourceworks is a small company, and we would rather show you the evidence than ask you to take our word for it. This page lists every provider that stores or processes your data and what they are audited against, explains how your private source list is isolated at the database level, says exactly what a company listing publishes and what it does not, and describes each control we run in plain language.
Database isolation
Row-level security on every customer table, enforced by Postgres
Your sources and AI
Never sent to any model, never used for training
RFQ email
Leaves from your own mail client; we never see replies
Our providers
SOC 2 Type 2 across the stack; ISO 27001 at Vercel, Airtable, Anthropic, Sentry
01 · Your private sources
What happens to a source list after you upload it.
The question we get asked most. This is about the source list you keep in your account; if you list your company on Sourceworks, your listing is covered in the next section.
Every private row is tied to your account at the database level
Each source, contact, folder, override and RFQ you create carries your user id, and the database enforces row-level security on every one of those tables: a query can only return rows whose owner matches the signed-in user. The policies are named for what they do (user_sources_self_read, user_source_overrides_self_update, and so on). This is enforced by Postgres, not by application code that could be bypassed.
The browser only ever holds a restricted key
The key shipped to your browser is subject to those row policies. The privileged server key that can read across accounts exists only on the server, is never bundled into the app, and is used only inside server code that has already checked who is asking.
Sharing is explicit and bounded
On Team and Enterprise plans, My Sources is shared among the members of your team; that is the point of a team plan. Sharing with another team happens only when you send a share and they accept it. No one outside your team can see your list.
Your sources never become part of the public Database
The Sourceworks Database is maintained separately, from public company websites and listings sellers publish on purpose. Nothing you upload is reviewed for inclusion, merged, de-duplicated into it, shown to other customers, or sold.
Your sources are never sent to an AI provider
SCOUT sends only your search terms to Perplexity. The listing-accuracy process sends Anthropic only the public web pages of companies in the directory. Your private list, contacts, notes and RFQ history are not inputs to any model, and we do not train models on customer data.
RFQs leave from your own email, not ours
Create Email opens a draft in your mail client with your chosen sources on the BCC line. Sourceworks does not send the RFQ, does not relay it, and never sees the replies. Your suppliers only ever hear from you.
We cannot see your source list
Our admin tools do not show your sources. What staff can see is account-level: your name, email, company, plan, billing status, usage counts and dates (how many searches, outreaches and sources, and when), and the messages you send us. No admin screen lists your sources, their contacts, your notes, what is in your folders, or who you sent an RFQ to, and no staff process reads them. The admin area itself requires a second factor (TOTP) on every session, and every administrative action is written to an audit log. The only time staff see any form of your private source information is if you decide to send us a spreadsheet or file through the free formatting service, for us to format and return to you for upload. Those files sit in a private bucket readable only through short-lived signed links, and we delete them upon completion of the formatting job.
You can take it out at any time
Delete any source, folder or RFQ yourself. Delete your account and your search and RFQ history is removed within 30 days; we keep only the minimal records that tax and accounting law require.
02 · If you list your company
What a listing publishes, and what stays yours.
Sellers put a listing in front of buyers on purpose. Here is exactly what that publishes, what it does not, and who is in control of it.
Your listing is public, and only what you put in it
An approved listing shows buyers your company name, website, locations, what you offer (materials, shapes, grades, services, fasteners) and the contacts you chose to receive RFQs. That is the whole of it. Your seller login, billing details, unpublished drafts and the review conversation are never shown to anyone.
A person reviews it before it goes live
A new listing, and any edit to it other than contact details, is checked by a Sourceworks reviewer before it is published, usually within two business days. Contact changes publish right away so RFQs reach the right people. Super Source listings publish offering edits without the review wait.
RFQs go from the buyer to you, not through us
A buyer who selects your listing emails you from their own mail client. Sourceworks does not relay the message, does not read it, and does not see your reply. The relationship is yours from the first email.
We do not tell sellers who saved or emailed them
Buyers' private source lists, folders and RFQ history are theirs. A seller is never shown which buyers saved their listing or sent them an RFQ, and claiming a listing does not reveal any buyer activity on it.
You keep control of it
Claim an existing listing or create one, edit it whenever you like, and ask us to take it down by emailing support@sourceworks.us. Listings never come down for non-payment: if Super Source lapses, the badge is removed and the listing stays.
Same safeguards as every account
Seller accounts sit on the same login, the same row-level security and the same staff-access limits as buyer accounts. A seller's drafts and review history are visible only to that seller and to the reviewer handling them.
03 · Subprocessors
Who runs the systems your data touches.
Sourceworks holds no servers of its own. Each provider below is linked to its own compliance page, where the attestations can be checked directly and current reports requested. Attestations are the provider's claims as published on October 16, 2026.
| Provider | Purpose | What of yours it handles | Attestations |
|---|---|---|---|
| SupabaseUnited States (AWS)supabase.com/security | Database, authentication and file storage. Everything you save in Sourceworks lives here. | Account and sign-in data, My Sources, folders, RFQ history, uploads and helpdesk attachments. For sellers: your seller account, listing drafts and review history.AES-256 at rest, TLS in transit. |
|
| VercelUnited States (Washington, D.C. region)security.vercel.com | Hosts and runs the application (sourceworks.us). | Requests pass through it; nothing of yours is stored here beyond short-lived logs. |
|
| StripeUnited Statesstripe.com/security | Subscriptions and payments. | Name, email and billing details, for buyer plans and for Super Source. Card numbers are entered on Stripe's own pages and never touch Sourceworks. |
|
| ResendUnited Statesresend.com/security | Sends Sourceworks' own emails: account notices, receipts, helpdesk replies, listing review decisions, newsletters you opted into. | Your email address, name and the content of the notification. |
|
| AirtableUnited Statesairtable.com/security | Where the public source directory (the Sourceworks Database) is maintained before it syncs into the app. | Nothing from a buyer account; private source lists never go here. For sellers: your listing, once approved, is the public record you asked us to publish (company, website, locations, offering, and the contacts you chose to receive RFQs). Nothing else from your seller account. |
|
| PerplexityUnited Statestrust.perplexity.ai | Powers SCOUT AI web discovery. | Only the search itself: material, shape, grade, your criteria text and, if you set one, the ZIP radius. Never your sources, contacts, RFQs or account details. |
|
| AnthropicUnited Statestrust.anthropic.com | Reads public supplier websites to keep Database listings accurate, and drafts the new-source newsletter. | None of yours. It only sees the public web pages of companies in the directory. |
|
| FirecrawlUnited Statesfirecrawl.dev/security | Fetches public supplier web pages for the listing-accuracy process above. | None of yours. Public websites only. |
|
| SentryUnited States (Google Cloud)sentry.io/trust | Error monitoring, so we find out about bugs before you have to report them. | Error details. Personal data is switched off in our configuration (sendDefaultPii: false). |
|
| Google WorkspaceUnited Statescloud.google.com/security/compliance | The support@sourceworks.us mailbox. | Whatever you send us by email, including files you send the formatting service. |
|
| Google AdsUnited Statesbusiness.safety.google/compliance | Conversion measurement on the public marketing pages only. | A conversion cookie on the marketing site. Not loaded inside the app, and not loaded at all when your browser sends Do Not Track. |
|
We will update this list before adding a provider that processes customer data. Customers with a DPA are notified of additions in writing.
04 · Security controls
Every control, in plain language.
Identity and access
Who can sign in, and what they can reach.
- Authentication
- Email and password through Supabase Auth, with passwords stored as salted bcrypt hashes. Sessions are cookie-based, refreshed server-side and revoked on sign-out.
- Concurrent-session control
- A second sign-in to the same account is surfaced to the user, who decides which session continues.
- Admin two-factor
- Every administrative page and API requires a time-based one-time code in addition to the password, on every session.
- Least privilege
- Users see only their own and their team's data. Team roles decide who can invite, remove and share. Staff privileges are granted to named individuals and recorded.
- Audit trail
- Administrative actions (plan changes, grants, data operations, publishing) are logged with who, what, when and the before and after state.
Data protection
Where data lives and how it is protected there.
- Encryption in transit
- All traffic to sourceworks.us and between the app and its providers uses TLS. HTTP requests are redirected to HTTPS and HSTS is set.
- Encryption at rest
- Database and file storage are encrypted at rest by Supabase on AWS (AES-256).
- Private storage
- Files you upload (spreadsheets for formatting, helpdesk attachments) go into private buckets. They are served only through time-limited signed links generated after an authorization check.
- Backups
- Supabase takes automated daily backups of the database. Backups inherit the same encryption.
- Data location
- Customer data is stored in the United States. The application runs in Vercel's Washington, D.C. region.
- Retention
- Account data is kept while the account is active. On deletion, search and RFQ history is removed within 30 days; billing records are kept as required by law. Unsubscribe and deletion requests are honored from support@sourceworks.us.
Application security
How the software itself is built and run.
- Row-level security everywhere
- Row-level security is enabled on every customer-facing table (56 tables at last count), so the database, not just the app, enforces isolation.
- Secrets
- API keys and database credentials are held as environment variables in the hosting platform, scoped per environment, never committed to source control, and rotated when staff or providers change.
- Server-side validation
- Uploads are parsed on the server with size and type limits. HTML we publish (blog posts) is sanitized against an allowlist; scripts and inline styles are stripped.
- Serverless hosting
- The app runs as managed functions on Vercel. There are no servers for us to patch, and the platform provides DDoS mitigation and a web application firewall.
- Dependencies
- The application is built from current, supported versions of its framework and libraries, and dependency updates are part of every release cycle.
- Rate limiting
- Search and lookup endpoints are rate-limited per user to prevent scraping of the Database.
Monitoring and incidents
How we find out when something is wrong, and what we do.
- Error monitoring
- Sentry captures application errors with personal data sending disabled.
- Provider status
- Supabase, Vercel, Stripe and Resend publish public status pages, linked below. An outage at any of them is visible there before we could write it up.
- Incident notification
- If we become aware of a security incident affecting your data, we will notify you at the email on your account without undue delay, and in any case within 72 hours of confirming it, with what happened, what was affected and what we are doing about it.
- Responsible disclosure
- Found something? Email support@sourceworks.us with "Security" in the subject. We acknowledge within two business days and will not take action against good-faith research.
Privacy and compliance
What we commit to, and what we do not claim.
- No sale of data
- We do not sell, rent or trade personal data or customer content, and we do not use customer content for advertising.
- GDPR and CCPA
- Our Privacy Policy sets out the rights of EU and California residents (access, correction, deletion, portability, no sale) and how to exercise them.
- Data processing agreement
- A DPA covering Sourceworks as processor and the subprocessors listed here is available on request.
- Security questionnaires
- We will complete your vendor security questionnaire. Expect answers that match this page; where a control does not exist we say so.
- What we do not hold
- Sourceworks itself is not SOC 2 or ISO 27001 certified and has not yet commissioned a third-party penetration test. Every system that stores or processes your data is operated by a provider that holds those attestations, listed above. We will update this page when our own status changes.
05 · Status
Is it up?
Sourceworks runs on the providers below, and their public status pages are the authoritative record of availability.
06 · Questions reviewers ask
Short answers, same facts as above.
- Where is my data stored?
- In Supabase's hosted Postgres database and file storage, on AWS in the United States, encrypted at rest. The application runs on Vercel in the United States.
- Who at Sourceworks can see my sources?
- Nobody. Our admin tools show account-level information (name, email, plan, usage counts and dates, your support messages), not your sources, contacts, notes or RFQ recipients. Admin tool access requires two-factor authentication and every action is logged. The only time staff see any form of your private source information is if you decide to send us a spreadsheet or file as part of our free formatting service, for us to format and return it to you for upload. We delete those files upon completion of a formatting job.
- Do you use my data to train AI?
- No. The only things sent to an AI provider are your SCOUT search terms (to Perplexity) and public supplier web pages (to Anthropic, for listing accuracy). Your sources, contacts, notes and RFQs are never model inputs, and we do not train models on customer data.
- Does Sourceworks send email to my suppliers?
- No. Create Email opens a draft in your own mail client; you send it. Sourceworks sends email only to you (account notices, receipts, helpdesk replies and newsletters you can unsubscribe from).
- Can I get my data out, or delete it?
- Yes. Delete sources, folders and RFQs yourself at any time. For a full export or account deletion, email support@sourceworks.us; deletion removes your search and RFQ history within 30 days.
- I list my company on Sourceworks. What is public and what is private?
- Public, because you asked us to publish it: your company name, website, locations, offering, and the contacts you chose to receive RFQs. Private: your seller login and billing, unpublished drafts, the review conversation, and which buyers saved or emailed you (we do not show sellers that). You can edit your listing at any time and ask us to take it down by emailing support@sourceworks.us.
- Will you sign a DPA or complete our security questionnaire?
- Yes to both. Email support@sourceworks.us with "Security review" in the subject.
07 · Documents
Available on request
- Data processing agreement (Sourceworks as processor, with this subprocessor list as its schedule)
- Completed vendor security questionnaire (your template or ours)
- Architecture and data-flow summary
- Provider attestations: we will point you to each provider's report request, since those reports are theirs to share
Related: Privacy Policy · Terms of Service
Changelog
What changed on this page
- 2026-10-16Trust Center published: subprocessor list, controls, incident commitment and disclosure process.
- 2026-10-16Added the seller side: what a listing publishes, what stays private, and how edits and removal work.
Sourceworks is a product of Flat Stock Labs LLC. Questions about anything on this page: support@sourceworks.us.