Your trust, documented.
Everything your legal, security and procurement team needs — in one place, no forms.
At a glance
- GDPR-proof by design — DPA included in every plan
- EU-hosted only: Frankfurt (Supabase) + Amsterdam (TransIP)
- AES-256 at rest, TLS 1.2+ in transit
- AES-256-GCM for customer API keys (BYOK)
- Multi-tenant isolation via Supabase Row Level Security
- Zero AI training on customer data
- 48-hour breach notification commitment
- B2B only — no consumer data processing
Data Processing Agreement (DPA)
Our Article 28 GDPR Data Processing Agreement is included in every plan and pre-accepted upon signing our Terms. Download the current version for your legal team.
Sub-processors
We notify all customers at least 30 days before adding or replacing any sub-processor.
Full list with contract terms →Infrastructure
Security measures
BYOK & LLM providers
Under our Bring Your Own Key model, customers maintain a direct relationship with each LLM provider (OpenAI, Anthropic, Google, Mistral) through their own API keys. LLM providers are not Custos sub-processors.
Customer API keys are encrypted with AES-256-GCM and decrypted only in memory at the moment of use — never logged, never visible to Custos staff.
Incident response
We commit to notifying affected customers within 48 hours of becoming aware of a security incident involving their personal data, as required by Article 33 GDPR.
Incident log
No incidents reported to date. This section will be updated transparently when any incident occurs, following the timeline set out in our DPA.
Security researchers can report vulnerabilities to . We respond within 48 hours and credit responsible disclosures in our changelog.