Last updated: September 8, 2026
● Not yet SOC 2 / ISO 27001 certifiedWe built Motalkz's data model around one rule: privacy is enforced in the database itself, not just in the app's UI. Below is what that actually means in practice, plus the providers we rely on and what they bring to the table.
Every table's access rules are enforced by Postgres itself — a signed-in member can only ever read or write what their own row-level policy allows, regardless of what the client app sends.
Every moderation action — suspending, unsuspending, resolving a report — is recorded with who did it and when, reviewable in the admin panel.
Messages, friend requests, reports, and every AI-assisted feature are capped per account per time window, enforced server-side, not just in the UI.
A database-level trigger blocks any account — including a compromised session — from granting itself admin rights or other privileged fields directly.
Uploaded file size and type are enforced server-side, not left to client-side validation alone.
Export your data, wipe your content while keeping your login, or close your account entirely — all available directly in Settings, no support ticket required.
18+ is enforced at signup by date of birth, checked both client-side and with a hard database constraint — not just a checkbox.
AI calls run only from server-side functions, never the browser, and receive only the specific content a feature needs — never a full profile or message history, and never used to train any model.
These are established providers that publish their own independent security attestations (including SOC 2 Type II) on their respective trust pages — we rely on their certified infrastructure rather than running our own data centers. We'd encourage checking each vendor's current status directly rather than treating this list as our own claim on their behalf.
As Motalkz grows, we're evaluating a formal SOC 2 and/or ISO 27001 audit — likely via a compliance-automation platform (e.g. Vanta, Drata, or Sprinto) paired with an accredited audit firm, rather than pursuing it unassisted. This page will be updated the moment that process actually starts, and again once any report or certificate is issued — we won't imply progress that hasn't happened.
Found a vulnerability? Please tell us before telling anyone else: [fill in: security contact email]. We'll acknowledge reports promptly and won't take legal action against good-faith, non-destructive security research.