Last updated: August 1, 2026

Security & Trust

Primagery builds business systems for operators who need reliability, clarity, and accountability. This page summarizes how we protect the Command Center, Client Portal, and the data you entrust to us.

SOC 2 program status

Primagery is executing a SOC 2 Type II readiness program mapped to AICPA Trust Services Criteria (Security, Availability, Confidentiality). We are not yet SOC 2 certified — we will update this page when a Type II report is available.

Platform architecture

  • Hosting: Vercel (TLS, edge middleware, serverless functions)
  • Database: Neon Postgres with encryption at rest
  • Documents: Private object storage (Vercel Blob) when enabled — not public URLs
  • Email: Resend with signed inbound webhooks

Access & identity

  • Invite-only team roster before any login is issued
  • Role-based permissions on every operator API route
  • Separate Command Center and Client Portal login surfaces
  • Client portal data scoped by authenticated client id
  • Login rate limiting and append-only security audit log
  • Human approval gates on automated agent (Wolfie) jobs

Application security

  • Security headers and Content Security Policy
  • Parameterized SQL; optimistic concurrency on shared state
  • CI pipeline: lint, tests, build, and dependency audit on every change
  • E-signatures record legal name, timestamp, and IP server-side

Payments & PCI

When card payments are collected, Primagery uses Stripe-hosted Checkout / Payment Links. Cardholder data (PAN/CVC) is entered on Stripe's pages and is not stored on Primagery servers. Stripe is a PCI DSS Level 1 service provider; our design goal is to stay out of card-data scope (typical SAQ A posture for fully hosted checkout).

  • We do not claim Primagery is PCI DSS certified as a card processor
  • Payment status and references may be stored; full card numbers are not
  • Live Stripe in production is enabled only when configured — see Subprocessors

Encryption in transit & at rest

  • In transit: TLS on Vercel for public HTTPS traffic
  • At rest: Neon Postgres encryption at rest; private Blob object storage when document vault is enabled
  • We do not claim client-side end-to-end encryption of all portal content

Insurance

Primagery maintains general liability and cyber liability insurance. Certificates of insurance are available to enterprise clients on request via info@primagery.com.

Compliance documents

Responsible disclosure

If you believe you have found a security vulnerability, please report it responsibly. We request that you do not publicly disclose issues until we have had a reasonable opportunity to investigate and remediate.

We aim to acknowledge reports within two business days. We do not currently operate a paid bug bounty program.

Enterprise inquiries

For security questionnaires, SOC 2 timeline, or custom DPA terms, contact info@primagery.com. We can provide subprocessors detail and a summary of controls under our readiness program.