Trust & Security

Security at Simple Commenter

Security built for teams that cannot cut corners, with the documents to prove it.

Simple Commenter is operated by Ander Digital OÜ, an Estonian company. We built this product inside regulated, brand-sensitive environments, so security is not an afterthought. This page summarizes how we protect your data and links to the documents you can share with your own security and procurement teams.

Security highlights

  • Hosting and storage. The application runs on Vercel. Our self-hosted MongoDB database, backups and S3-compatible file storage are on Hetzner in Finland; Redis is in Stockholm. Primary EU storage is separate from international processing by email, payment, AI and integration providers.
  • Access and application controls. Role and project access checks, scoped and revocable integration credentials, input sanitization, signed payment webhooks, HTTPS and bcrypt password hashing protect service access. Our policy requires provider MFA and regular access reviews.
  • AI processing and control. Simple Commenter now includes AI features using Anthropic and, for enabled location suggestions, TypeSafe. Developer briefs default on at project level. Workspace owners can turn AI off for the account, blocking built-in AI and AI/MCP access across all projects and roles. Previously sent data is not recalled.
  • Supplier transparency. Our sub-processor list describes core hosting, AI, customer-selected integrations and website services, including the limits of EU residency claims.
  • Response and recovery. Incident response and continuity plans are available for security screening. Recovery objectives are planning targets; backup and restore evidence must support any customer-specific commitment.
  • Certification. Ander Digital OÜ does not hold ISO 27001 certification. Supplier certifications apply to their own services and do not certify Simple Commenter.

Security documents

Read these directly:

Available on request under NDA:

  • Incident Response Plan
  • Business Continuity Plan

To request these, email aleksander@simplecommenter.com.

Enterprise

SAML SSO is implemented for entitled accounts, including Enterprise arrangements and eligible add-ons. Contact us to agree identity-provider setup, AI restrictions, a DPA, service levels and the Council or organization's implementation scope. Discuss your requirements.