Trust, security & data handling

Commers handles sensitive customs and trade data on behalf of licensed brokers and importers. This page explains where that data lives, how it is protected, how long we keep it, and exactly how our AI uses it. We describe the controls that are in place today and clearly mark what is planned — if something is not yet built or certified, we say so.

Summary. Your data is stored and processed in the United States, isolated to your organization behind an authenticated login, with every change written to an append-only audit trail. Data is encrypted in transit and at rest. Our AI learns from your data to classify your goods — private to your account by default, and shared with a wider model only if you explicitly opt in.

Infrastructure & hosting

Commers runs on a small, deliberately simple stack. Fewer moving parts means a smaller attack surface and fewer places for data to reside.

• Stored and processed in the United States. Customer records live in a US-West database (Northern California) and are processed by a US-West API (Oregon). The web app's public assets are cached on a global CDN — that is the application interface, not customer data.
• Built on AWS. Our database and application hosting run on Amazon Web Services in US regions. AWS maintains its own SOC 2, ISO 27001, and related certifications for the physical, environmental, and network layers, which our platform inherits.
• One database, not many. All persistent data lives in a single PostgreSQL database, organized into a schema per product area. There is no separate data lake or analytics warehouse holding a second copy of your records.
• Same-origin sessions. The web app proxies API calls through its own origin, so your session cookie is never a third-party cookie and never leaves the domain.
• The AI is a narrow dependency. Only the classifier and the document extractor call an external model. Everything else — screening, duty calculation, the entry state machine, reporting — runs inside our own infrastructure.

Sub-processors. The third parties that process data on our behalf are Amazon Web Services (US cloud infrastructure) and Anthropic (AI classification and extraction). A current sub-processor list is available to customers on request.

Data security

Access to your data is closed by default. Every control below is implemented in the product today.

Data ownership & retention

• You own your data. Your data belongs to you. We hold it only to operate the service on your behalf — never to resell, and never to benefit another customer. You may request an export or a deletion at any time.
• Your data stays in your book. An importer's customs record is stored inside its broker's book, where it legally belongs. Commers does not distribute copies of it across separate systems.
• Provenance is append-only. Classifications, corrections, screening results, and every mutation are recorded as history rather than overwritten, so there is always a defensible, auditable record of how a figure was reached and who changed it.
• Backups. The database runs with automated daily backups and point-in-time recovery on the managed platform. Our operational practice also retains at least one encrypted snapshot off-platform, so a provider-account incident is not a total-loss event — and we test restores rather than assume them.
• Deletion and revocation are first-class. Logins and sessions can be removed on request, which ends access immediately; records can be deleted on request.
• Demo data is gated out of production. All data-generation tooling is disabled in production by a hard switch, so a live customer environment never mixes real records with synthetic demo data.

The AI model & your data

Commers gets better at classifying your goods by learning from your data — every classification a broker confirms or corrects teaches the system to get the next matching line right. You control how that learning is used:

• Segregated — private to your account (the default). Your data trains only your own classification. Your entries, corrections, and the model behavior they shape stay isolated to your organization — never shared with, visible to, or used to benefit another customer.
• Shared — only if you opt in. You may choose to contribute your confirmed corrections to a wider model, so classification accuracy improves for everyone and you benefit from other participants' corrections in return. This is a deliberate opt-in, never the default.

Whichever mode you choose, the same guardrails hold:

• A licensed broker stays in the loop. The AI proposes; a broker approves. Nothing is filed on the AI's decision alone.
• Every classification is grounded and cited. The model reasons from the live U.S. tariff schedule (HTSUS) and CBP's binding rulings (CROSS) and cites the basis it relied on, so a broker checks the reasoning rather than trusting a number.
• The model cannot invent a tariff code. Every classification is validated against the live HTSUS; a code that does not exist is rejected.
• Your data stays in the United States. The learning and storage described here happen in our US region (see Infrastructure & hosting), segregated by organization.
• The foundation-model provider does not train on your data. Document and line data sent to our underlying AI provider is processed under its commercial terms and is not used to train that provider's own foundation models. The learning that improves classification happens inside Commers, under the segregated / opt-in-shared choice above.

Compliance & what's next

We build to the controls a SOC 2 audit examines — access control, encryption, audit logging, and backups — and our SOC 2 program is underway. Target: SOC 2 Type I by Q3 2026 and Type II by Q1 2027. We do not yet hold a report, and we will publish it here once we do.

The following are planned and not yet in place. We list them so you know exactly where we are:

• Database-level row security (RLS) as defense-in-depth. Isolation is enforced in the application layer on every query today; replicating that rule inside PostgreSQL is a hardening step we add before onboarding organizations onto shared infrastructure.
• Self-service authentication — email verification, password reset, MFA, and SSO — for rollout beyond supervised onboarding.
• Formal incident-response and breach-notification procedures, as part of the SOC 2 program.
• Self-hosted / on-premise deployment — running Commers inside a partner's own environment, for organizations whose policy requires it. A later roadmap item, not available today.

Questions

If you are evaluating Commers for a security or procurement review and need more than this page provides — a specific control, a data-flow diagram, our current sub-processor list, or the status of a roadmap item — contact your Commers point of contact. We are glad to go into detail, under NDA where appropriate. We would rather answer precisely than have you guess.