Trust Center
Security Overview
Controls: Security Whitepaper.
Compliance
| Standard | Status |
|---|---|
| SOC 2 Type II | Following aligned practices; formal audit planned |
| ISO 27001 | Planned |
| Penetration testing | Third-party testing planned |
| WCAG 2.2 Level AA | Accessibility statement |
How to verify AI marking
Look for:
- PDF / Word document properties and footers containing
AI-generated content · Motifand amotif-ai-provenance/1unique id. - JSON exports: top-level or metadata
provenanceobject withaiGenerated: true. - Excel:
_motif_provenancesheet. - CSV: leading
# motif-ai-provenance/1 …comment line. - GraphML: graph-level
aiGenerated/motifMarkingdata keys. - Long assistant clipboard copies:
[AI-generated by Motif]prefix. - Shared findings / copied association text: same clipboard prefix.
Data Residency
- Stored data (database, object storage, cache, application hosting): United States
- AI pipeline compute: Netcup VPS (may process query and document content outside the United States)
- AI inference: Performed by third-party model providers via OpenRouter. Depending on routing, these providers may process query and document content outside the United States and EU.
- Planned: EU stored-data options on roadmap
Subprocessors
| Provider | Purpose | Location | Certifications |
|---|---|---|---|
| Vercel | Application hosting | USA | SOC 2 |
| Netcup | AI pipeline compute | EU | ISO 27001 |
| Neon | PostgreSQL database | USA (AWS) | SOC 2 Type II, ISO 27001 |
| Cloudflare | Object storage for uploaded documents and session replay recordings (when session-replay consent is given); status-page subscriber emails | USA | SOC 2, ISO 27001 |
| Upstash | Redis cache and job queue | USA | SOC 2 |
| OpenRouter | AI inference gateway (routes to third-party LLM providers) | USA; routed providers may be outside US/EU | Per routed provider |
| OpenAI | Moderation of profile and organization names (flagged names are rejected) | USA | SOC 2 |
| Stripe | Payments | USA | PCI DSS Level 1 |
| Resend | USA | SOC 2 | |
| Slack | Community and personal support chat | USA | SOC 2 |
Other parties
These parties are not subprocessors. Google sign-in and reCAPTCHA run so Google can operate those services. Google Analytics and the Meta Pixel run only after consent, for their own analytics and advertising.
| Party | Purpose | Location |
|---|---|---|
| Authentication (OAuth), bot protection (reCAPTCHA), and analytics (when consented) | USA | |
| Meta | Advertising measurement (when marketing cookies are consented to) | USA |
LLM providers in the OpenRouter route: on request at hello@motif.bio.
We provide 30 days notice before adding a subprocessor that processes personal data. Subscribe: hello@motif.bio.
Incident Response
Responsible Disclosure
Email hello@motif.bio. We acknowledge reports within 48 hours, provide status updates, credit researchers if desired, and take no legal action for good-faith research.
Contact
| Purpose | |
|---|---|
| Security | hello@motif.bio |
| Privacy | hello@motif.bio |
| Legal/DPA | Data Processing Agreement; countersigned copy at hello@motif.bio |
| Support | support@motif.bio; Slack channels in Support & SLA |
Last updated on