How we protect your winery’s data.
The AI Sommelier runs your members’ events under your brand, on your catalog. That makes your member data and your catalog yours to trust us with. So here is exactly how it is isolated, encrypted, and governed, in plain language. This page is a living document and doubles as a one-pager: print it or save it as a PDF for your security review.
Last updated: July 2, 2026
Tenant isolation & data scoping
Every partner is a separate tenant. One winery can never see another’s members, catalog, or events.
- Application-enforced tenant scoping. Every data-access path is keyed to a single tenant. Nothing reads across tenants by design: not the app, not the AI, not a support query.
- An automated cross-tenant isolation test suite. We seed two tenants and assert that every data-access helper returns zero cross-tenant rows, with a completeness guard so a new helper can’t ship untested. The suite runs in continuous integration on every change. Isolation is proven, not assumed.
- Server-verified recommendations. The AI can only cite wines that exist in your catalog. Every SKU, vintage, and price on a recommendation is verified server-side against your list, so the model can never invent a product you don’t sell.
- An append-only admin audit log. Every administrative change records who did it, to which tenant, and what changed: a tamper-evident trail for due diligence.
Encryption & secrets
Data is encrypted in transit and at rest, and any credential you hand us is encrypted before it is stored.
- In transit: all traffic is served over TLS (HTTPS). There is no unencrypted path to the application.
- At rest: your database and backups are encrypted at rest by our infrastructure provider.
- Bring-your-own model keys, encrypted: if you run the Sommelier on your own AI account, the API keys you supply are encrypted with AES-256-GCM before storage. They are never written to logs, never placed in URLs, and never returned to the browser.
Infrastructure & subprocessors
We do not hold our own SOC 2 report. Instead we build on a small set of vetted providers and inherit their independently audited controls: the honest posture for a focused team, and the one we’ll keep as we grow.
| Provider | What it does | Compliance |
|---|---|---|
| Supabase | Postgres database & authentication | SOC 2 Type II |
| Vercel | Application hosting & delivery (US region) | SOC 2 Type II |
| Anthropic | AI model inference (drafting & recommendations) | SOC 2 Type II |
| Stripe | Payments & billing | PCI DSS Level 1 |
| Resend | Transactional & lifecycle email delivery | SOC 2 Type II |
Built on SOC 2-certified infrastructure, not a Wine Hound SOC 2.
Authentication & access
Accounts are age-gated at signup, and we’re candid about how sessions expire.
- Age gate at signup. Every account confirms legal drinking age before it is created. This is a wine product, and that check is not optional.
- Sessions and revocation, stated honestly. Sessions are JSON Web Tokens capped at 24 hours. That means a revoked session can remain valid until it expires, up to 24 hours. Live access checks on every sensitive action compensate, so a removed user loses access to protected data immediately even while a token lingers.
Compliance & your data rights
Your catalog, your member list, and your members’ data belong to you. You can take them with you at any time.
- Data residency: data is stored and processed in a single United States region. EU residency is available on request for enterprise agreements; we won’t promise it as a default we don’t yet run.
- Full portability: a complete export of your tenant data, in a machine-readable form, on request, at any time, and again at offboarding.
- Deletion on request: we delete your tenant data within 30 days of a written request following export. When a partnership ends, your members can migrate their own cellar and event history. Nobody loses their data.
- Consent-first email. Lifecycle emails are opt-in: announcements and invitations go out from your own list, and we email a member only after they have activated an account. Consent stays with your list, and every message carries one-click unsubscribe. We never auto-provision accounts from an imported list.
These commitments are reflected in our privacy policy and terms; a mutual data-processing agreement accompanies every partner agreement.
Alcohol & regulatory posture
We recommend wines; we never sell or ship them. The Sommelier plans the night and points to the bottle. Every sale, every shipment, every payment runs on your platform, under your licenses. All direct-to-consumer alcohol licensing, shipping law, and tied-house exposure stay with you, the winery. That is deliberate: it keeps a whole category of regulatory risk off the software and where it already lives, and it means adding the Sommelier changes nothing about how you’re licensed to do business.
Availability & support
- 99.5% availability target. We run on managed, SOC 2-certified hosting and monitor uptime continuously.
- Next-business-day support response. Reach a human by the next business day; during a pilot, theme and catalog changes are handled for you.
- No financial service credits. We’re direct about this: availability is a target we work hard to hold, not a credit-backed SLA. A billing lapse degrades members to free-tier limits with a neutral notice. It is never a lockout, and no member loses their cellar or event data.
Questions from a security or procurement review? Bring them to the partner conversation. We answer plainly, and we’ll walk your team through any of the above.