Data & Trust

01Where we stand

What this site does, and what it does not

The good rows are good because of what this site does not do, not because of what it has been certified to do. The rest say so.

In placeTrue and working today.
In progressA working interim exists, but it is not the final answer.
Not yetIt does not exist. We would rather say so.

Aware trust posture: area, what is true today, and status
Area	Today	Status
Cookies	None. This site sets no cookie, which is why there is no consent banner and nothing to opt out of.	In place
Trackers	None. No analytics, tag manager, session recorder or advertising pixel is loaded on any page.	In place
Third-party requests	None while you are reading. Both typefaces and the globe's country borders are compiled into the site at build time and served from this origin, not fetched from a font or map CDN.	In place
Requests we make	One, to this site's own /api/lead, and only at the moment you submit a form. Nothing on any page calls a third-party host.	In place
What a form collects	Your name, work email and company; whatever you choose to put in the optional role, seats and use-case fields; the page you submitted from; and any campaign parameters already in the URL.	In place
Your IP address	Used for an in-memory rate limit on the lead form — five submissions per ten minutes — and never written to storage.	In place
Payment data	None is collected anywhere on this site, trials included. There is no card field and no payment processor in the path.	In place
Vulnerability reports	Send them to contact@iamaware.us. There is no dedicated security address yet, and we are not publishing a response window we have not committed to.	In progress
Privacy requests	Sent through the same contact channel until a dedicated privacy address and an identity-verification step exist.	In progress
Data processing agreement	Not published. Ask for one at contact@iamaware.us and we will tell you exactly where it stands rather than send you a template nobody has reviewed.	Not yet
Retention periods	Not documented. The Privacy Notice says so in its own words instead of naming a period no one has set.	Not yet
Audits and certifications	Aware publishes no third-party audit, certification or penetration-test report — no SOC 2, no ISO 27001, no FedRAMP authorization. Nothing on this page has been reviewed by an auditor.	Not yet
Data residency	Not offered as a commitment. Deployment options for Enterprise engagements are described on the Enterprise page and confirmed in writing before contracting.	Not yet
Contracting entity	Not stated. The draft Terms omit the contracting entity, registered address, governing law and venue rather than print a placeholder over them.	Not yet
The product itself	Out of scope for this page. Encryption, access control, logging, incident response and residency for the Platform and the Signals API are not documented publicly yet, and this page will not imply otherwise.	Not yet

We will not describe a control as audited until someone has audited it, and we will not name a certification, an auditor or a report date before one exists.

02Subprocessors

Every third party that can see your data

These vendors sit between you and Aware on this site. The ones marked not in service are configured and dormant — they are listed anyway, so that nothing can begin processing without having been disclosed here first.

NetlifyIn service: Builds, hosts and serves this website.; SeesEvery page request you make to this site.
FormSubmitIn service: Delivers form submissions to Aware by email.; SeesEverything the form collected — your name, work email, company, any role, seats or use-case text, the page you submitted from, and any campaign parameters.
SupabaseNot in service: Would store form submissions in a leads table.; SeesThe same fields, written as a row.; Dormant. The lead route writes to Supabase only when three server secrets are set on the deployment; where they are not, submissions go to FormSubmit instead.
ResendNot in service: Would email Aware the notification for a stored submission.; SeesThe same fields, in the body of that notification.; Dormant under the same condition as Supabase — the two are configured together.

We do not yet publish the processing region for each vendor, so this register does not claim one. Ask and we will confirm in writing what we know. Aware does not store your IP address — it is used for the lead-form rate limit described above and then discarded — but what each vendor records in its own logs is governed by that vendor's terms, and this register does not claim otherwise.

03Paper

The documents, and their real status

Both legal documents on this site are published as drafts and served noindex, so that an unfinished document is not what a search engine offers someone looking for Aware's terms. They are published at all because a reviewer is better served by a real draft that names its gaps than by a finished-looking page nobody has read.

Privacy Notice: Draft. Carries the same subprocessor register, and states plainly which of its own sections describe work that is not finished.Read the Privacy Notice
Terms of Service: Draft. Limitation of liability, the contracting entity, governing law and venue are omitted rather than shown as placeholders.Read the Terms
Data processing agreement: Not published. Request it at contact@iamaware.us. If you need your own paper signed instead, send it and we will redline rather than refuse.
How a conclusion is traced: Provenance of the reasoning — the source-to-conclusion chain behind anything Aware tells you — is a different question from this page, and it has its own section on Technology.See the chain of record

Ask us something this page does not answer

If your review needs an answer that is not here, ask for it directly. You will get the real status, including “we do not have that yet” where that is the answer.

Contact Aware

Or email contact@iamaware.us. There is no separate security address yet; this is the one channel, and saying so beats publishing an address that bounces.