Trust center
Everything a procurement team, auditor or careful client asks for, in one place: accessibility, privacy, payments, backups, security and the commitments of the providers we build on. Where something is unfinished or self-assessed, we say so.
At a glance
Accessible by design
Built to WCAG 2.2 AA, Section 508 and EN 301 549. Keyboard first, light and dark, high contrast, reflow to 320 pixels. Self-assessed report available.
Private by default
Invitation-only, separate workspaces enforced in the database, no data sale, no ads, no analytics inside the app. GDPR, UK GDPR and CCPA/CPRA rights supported.
Card data never touches us
Payments run through Stripe on Stripe-hosted pages. Stripe is certified to PCI DSS Level 1, and we qualify for the shortest PCI questionnaire.
Backed up every hour
Full encrypted backups of the database and accounts, on the hour, held at a separate provider. 35 days of hourly copies and 90 days of daily copies.
Your data is yours
Download everything any time as CSV, Excel or JSON. Delete your account yourself. Read-only share links expire.
Honest about status
Not yet SOC 2 or ISO 27001 certified. Accessibility is self-assessed. Policies are drafts under legal review. We publish what is done and what is not.
Compliance at a glance
| Framework | What it asks of us | Where we stand | Evidence |
|---|---|---|---|
| Section 508 (US federal accessibility) | Web, software and documentation meet the Revised 508 Standards (WCAG 2.0 A/AA and more). | Self-assessed, mostly supports. One export gap (untagged calendar PDF). | ACR, section 3 |
| WCAG 2.2 Level AA | All Level A and AA criteria, including the nine added in 2.2. | Self-assessed: 47 of 55 criteria supported, 1 partial, 7 media criteria not applicable. | ACR, section 2 and the audit package |
| ADA Title II and III | Title II (public bodies) requires WCAG 2.1 AA by April 2027 or 2028. Courts use WCAG for Title III. | Our WCAG 2.2 AA conformance helps public-sector and private customers meet their duties. | ACR, section 5 |
| European Accessibility Act, EN 301 549 | Web and documents meet EN 301 549 (WCAG 2.1 AA today, WCAG 2.2 in the new edition). | Self-assessed; mapped clause by clause. | ACR, section 4 |
| GDPR and UK GDPR | Lawful basis, rights, processor terms, transfers, breach notice. | Policies, DPA template, subprocessor list and rights process in place. Pending legal review. | Privacy, DPA, subprocessors |
| CCPA / CPRA and other US state laws | Notice at collection, no sale or sharing, opt-out signals, consumer rights. | We do not sell or share personal information, and we honor Global Privacy Control. | Privacy, section 9 |
| Web analytics and cookies (ePrivacy) | Consent before non-essential cookies; honor opt-out signals. | Google Analytics loads only after opt-in, is off for Global Privacy Control, and is absent from the app. | Cookie Policy |
| PCI DSS | Protect card data. | Card data is entered only on Stripe-hosted pages (Stripe is PCI DSS Level 1); IdeaLine qualifies for the shortest self-assessment, SAQ A. | Payment Terms, section 7; Stripe PCI guide |
| SOC 2, ISO 27001 | Independent audit of security controls. | Not yet certified. We are building to the same controls and will not claim a report we do not hold. | Security, section 5 |
| HIPAA | Protected health information. | IdeaLine is not designed for health records. Please do not store them. | Data Policy |
Nothing on this page is legal advice or a certification. Statements of conformance describe our own assessment on the date shown.
Accessibility
Standard
WCAG 2.2 Level AA across the website, legal pages and application. Covers Section 508 and EN 301 549 web requirements.
Report
The Accessibility Conformance Report follows the VPAT 2.5 structure for WCAG 2.2, Revised Section 508 and EN 301 549, with a remark and evidence reference for every criterion.
Audit package
The audit package lists every front-end feature, the test evidence and the fixes we made, so your team can repeat the checks.
Known gaps
Calendar PDF, PNG and JPG downloads are not accessible (use Excel or CSV). Optional "don't ask again" on deletes. Screen-reader testing is still to do. All listed in the statement.
Privacy and analytics
GDPR and UK GDPR
Lawful bases per purpose, data subject rights, EU Standard Contractual Clauses in the DPA, 72-hour breach notice target, subprocessor list.
CCPA / CPRA
We do not sell or share personal information. Notice at collection and rights are in the Privacy Policy.
Analytics
Google Analytics 4 runs on this marketing site only after you accept. It does not store IP addresses, Google signals and ad features are off, and the Global Privacy Control signal is honored as a decline. The app has no analytics.
Data requests
Write to the privacy contact in the policy. Most things are self-service: export, edit, delete, close the account.
Payments and PCI
Stripe-hosted
Card details are typed on Stripe's pages and sent directly to Stripe. They never pass through our site, servers, logs or backups.
PCI DSS
Stripe is a PCI Service Provider Level 1. IdeaLine qualifies for SAQ A and protects the pages that lead to payment. See the Payment Terms.
Stripe resources
Backups and recovery
Every hour, on the hour
A full copy of every table and the account list is taken at the top of each hour (UTC), compressed and encrypted with AES-256-GCM before it leaves our server.
A separate provider
Backups are stored in a private Cloudflare R2 bucket, apart from the database host, so one provider problem cannot take both.
Retention
Hourly copies for 35 days, daily copies for 90 days. Each backup is read back to verify it, failures alert us, and the status page shows whether the last backup is current.
Rollback
If a release goes wrong, the website is rolled back to any earlier version in seconds. If data is damaged, an administrator restores from a chosen hour. Goal: lose at most one hour of changes.
Details and limits are in the Data Policy. Deleted data can remain in encrypted backups for up to 90 days.
Reliability: our providers' published commitments
| Provider | What it runs for IdeaLine | Published uptime commitment | Applies to | Read it |
|---|---|---|---|---|
| Supabase | Database, sign-in, live updates | 99.9% monthly uptime for each product; service credits of 10% to 30% of the fees for the affected service. | Enterprise plans | Supabase SLA |
| Vercel | Website, application and server functions | 99.99% availability of the platform serving content, excluding listed events; credits of 10% to 50% of monthly fees. | Enterprise agreements | Vercel SLA |
| Cloudflare | Domain name system, edge network, backup storage | 100% of the time serving customer content, with credits for outages; Enterprise customers have a separate agreement. | Business plan and above | Cloudflare Business SLA |
These are the service commitments our infrastructure providers publish. Which commitment applies depends on the plan we hold with each provider; check each link for current terms. They are the providers' commitments, not promises IdeaLine makes to you. For live availability see our status page.
Provider security pages: Supabase, Vercel, Cloudflare.
Built for how marketing work really gets done
Agencies
Tag the client behind every project without giving them a seat, share expiring read-only links for review, keep an exportable activity log, and answer client security reviews with the documents on this page.
In-house marketing and communications
Roles and permission levels you can rename, approvals in order, branded reports and a DPA for your legal team (Studio).
Solo proprietors and one-person teams
Starter is $19 a month or $200 a year. Everything exports to files you own, nothing is locked in, and you can delete your account yourself.
Project professionals
Follow work from first spark to scheduled project: the idea line, templates, calendar, board, content repository, comments, approvals and reports in one place.
Documents to download
Each legal document is shown on its own page and can be downloaded. Terms and policies are drafts that legal counsel will review and revise; the version you agree to is the one in force when you accept it.
Questions from your auditor?
Security questionnaires, the signed DPA, accessibility questions and requests for other formats: write to hello@idealine.io. We reply with what we have and tell you plainly what we do not.