Trust & Security

The short version

MARCO uses an Australian database and Sydney application hosting. Some service providers process data overseas. Every connection is encrypted, and your saved formulas are treated as commercially sensitive — they are never shown to other customers or to manufacturers unless you explicitly request a quote.

If you find a security issue, email security@trustmarco.com and we will respond within 24 hours.

This page covers how we look after your account data. For where the regulatory content itself comes from — the exact TGA, FSANZ, ANVISA, Health Canada, FDA and AICIS registers behind every verdict, each linked to its primary source — see Data Sources.

Where your data lives

The application runs in Vercel’s Sydney region and the database is hosted on Supabase in Sydney. AI screening uses Anthropic, and caching, email and monitoring involve other providers. Data sent to these services may be processed outside Australia. See our Privacy Policy for the data involved.

A handful of well-known providers help us run the service. Stripe processes payments (we never see card numbers). Resend sends transactional email. Cloudflare sits in front of the site for DNS and bot protection. Sentry collects error reports from the application code.

The full sub-processor list is in our Privacy Policy, and we notify customers before adding a new one that handles personal information.

How we protect it

Every page and API call is served over HTTPS, and browsers are instructed to refuse any plain-HTTP fallback. Customer data is encrypted at rest in the database and in file storage. The site sets the standard hardening headers a modern web app should set (clickjacking, MIME-sniffing, and referrer leakage are all blocked), and we do not ask for camera, microphone, or location access from the browser.

Sign-in is handled by Supabase Auth. Passwords are stored as one-way hashes — we never see them in plain text. Sessions use short-lived access tokens that rotate automatically. Two-factor sign-in and single sign-on (Google Workspace, Microsoft Entra) are on the roadmap for the Team plan.

Customer accounts are isolated at the database level: queries running under your login can only return rows that belong to you. The keys that bypass this isolation are restricted to server-side code and rotated when staff change.

Your formulas, specifically

Formulas you submit are commercially sensitive, and we treat them that way. They are encrypted at rest, and access is gated by your account. If you delete your account we delete your formula records, except where we are legally required to keep something (for example, tax records of payments).

Continuity

Database backup and recovery depend on the configured Supabase plan and retention settings. We do not advertise a recovery-time guarantee or a verified restore test here. Ask us for the current recovery arrangements if these are part of your procurement requirements.

Sentry records application errors. The service status page checks application and database availability when you open it. It does not represent an uptime history or a guarantee that every regulatory source is current.

Compliance, honestly

We operate under the Australian Privacy Principles, and our breach response follows the Notifiable Data Breaches scheme. Stripe handles card payments, which keeps us out of card-data scope.

We do not currently hold a SOC 2, ISO 27001, or HIPAA attestation, and we will not claim one we do not have. SOC 2 Type I is on the roadmap for when our enterprise pipeline justifies the engagement. If you need to satisfy a procurement checklist before then, the next section is for you.

Reporting a security issue

Coordinated disclosure is welcome. Email security@trustmarco.com with details and, where possible, a proof of concept. We will acknowledge within 24 hours and keep you updated through to resolution.

We ask that you give us a reasonable window (90 days by default) before public disclosure, do not access data that is not your own, do not run automated scanners against authenticated endpoints, and do not affect service availability.

Machine-readable contact information is at /.well-known/security.txt.

For procurement teams

Need a vendor questionnaire filled out, a DPA signed, or a security walkthrough? Email sales@trustmarco.com and we will turn it around within a few business days.