How Ancor looks after your data
Last updated: October 26, 2026
An agency that moves to Ancor hands over its invoices, its client list, its team's hours and sometimes salaries. Ancor is a young company run by one person, so this page says plainly what is in place today and what is not. The legal side (the data processing agreement and the subprocessor list) is collected in the trust centre.
Where your data lives
The app, the database, the AI, uploaded files and the backups all run in Mumbai, India.
| Part | Provider | Region |
|---|---|---|
| The app (the server that runs Ancor) | Google Cloud Run | Mumbai (asia-south1) |
| The database | Supabase (PostgreSQL) | Mumbai (ap-south-1) |
| AI features | Google Gemini on Vertex AI | Mumbai (asia-south1) |
| Uploaded files | Google Cloud Storage | Mumbai (asia-south1) |
| Daily backups | Google Cloud Storage | Mumbai (asia-south1) |
A few smaller parts run outside India, and we would rather you heard it from us:
- A short-lived cache (Upstash, in Tokyo, Japan) holds rate-limit counters and copies of sign-in session data and some computed summaries for 30 minutes at most. The connection to it is encrypted.
- Email is sent through Resend from Tokyo, Japan.
- Error reports go to Sentry in the United States. A report can include the user's ID, email address and the request that failed; passwords, tokens and cookies are removed first.
- In-app product analytics go to PostHog in the EU, only for people who agree to analytics cookies.
- Server logs are kept in Google Cloud Logging's global storage.
On the way to the server, your browser's requests pass through Cloudflare and Firebase Hosting, which serve the website and forward app traffic. Payments for Ancor's own plans go through Razorpay in India. The full list, with the transfer safeguard for each, is on the subprocessors page.
Who can see what inside your agency
- Money stays with the people who handle money. Margins, revenue, billing rates and invoices are shown only to the owner, admin, operations and finance roles. Team members, team leads and contractors do not see them.
- Contractors see only their projects. A contractor is limited to the projects they have been added to.
- Clients see only what you share. The client portal shows the work and approvals you send it. Internal notes never reach it, and an automated test blocks any change that would let them.
- Each agency is kept apart. Every request is tied to the agency the person signed in to, and data is read and written only for that agency.
How it is protected
- Encrypted in transit. Every connection uses HTTPS (TLS), including the connection from the server to the database.
- Encrypted at rest. The database, the backups and stored files sit on disks that Supabase and Google Cloud encrypt.
- An extra layer for the most sensitive fields. Salary figures (monthly and annual CTC, variable pay), the access and refresh tokens for tools you connect, and two-factor secrets are encrypted again by Ancor with AES-256 before they are stored. Other data, such as invoices and client names, relies on the disk encryption above.
- Passwords are never stored. Only a one-way hash (Argon2) is kept. Repeated failed sign-ins lock the account for a while.
- Two-factor sign-in for everyone. Any user can turn on two-factor sign-in with an authenticator app, with one-time backup codes. The founder's Ancor admin account uses it, and the Google Cloud account that runs Ancor has 2-step verification on.
- An audit log. Sign-ins, failed sign-ins, data exports, deletion requests, role changes, two-factor changes and other sensitive actions are recorded with who did it and when.
- Secrets out of the code. Database passwords and API keys are held in Google Secret Manager, not in the code.
Who at Ancor can see your data
Ancor is one person today: Rushabh Porwal, the founder. As the person who runs the service, he has technical access to the production systems, so he can see workspace data. He uses it only to run, support and fix the service. We will not pretend otherwise.
Inside the product, opening your workspace from Ancor's admin console takes a logged access: a written reason and a time limit of at most four hours. Your workspace owners are told in the app and by email each time, can see every access under Settings, and can end it early. Each access, and any change made during it, goes into your workspace's audit log.
Your workspace data is used to provide the service to you. It is not sold and it is not used for advertising. To give new workspaces sensible starting points, Ancor uses a few statistics combined across workspaces, for example how many days a type of deliverable usually takes (that one needs at least five agencies before it is used). These are numbers, not records: no agency ever sees another agency's projects, clients, people or money.
The AI
- The AI features run on Google's Gemini models through Vertex AI, in the Mumbai region.
- Under Google Cloud's terms for Vertex AI, Google does not use this data to train its models.
- Before anything is sent to the AI, the server strips out things that look like secrets (API keys, access tokens, private keys) and trims oversized text.
Backups
The whole database is copied once a day and each copy is kept for 30 days, in Mumbai. A backup is only worth something if it restores, so we test that: on 23 October 2026 the newest copy was restored into a fresh database in about 40 seconds, without errors, and the agencies' projects, tasks and timesheets were all in it.
If something goes wrong
- Monitoring. Google Cloud checks the API every 5 minutes. An outage or a spike in errors sends the founder an email alert, and application errors are reported to Sentry. There is no public status page yet; the live health check is at getancor.com/api/health.
- A personal data breach. If your agency's data is lost, changed or seen by someone who should not have seen it, we tell your workspace owners by email without undue delay and within 48 hours of finding out. The notice says what happened, whose data and what kind, the likely effect, what we have done and what we will do, and we send updates as we learn more.
- Containing it. We stop the cause first (revoke keys, end sessions, roll back a release), then work out what was affected from the audit log and server logs.
- No uptime guarantee. We do not offer a service level agreement today.
Taking your data out, and deleting it
- Export any time. The owner or an admin can download a full export of the workspace from Settings, whenever they like. Invoices can also be exported for Tally.
- After a trial. If a trial ends without a plan, the workspace goes read-only for at least 30 days. You can still sign in, see everything and export it.
- Deleting the workspace. The owner can ask for the whole workspace to be deleted. There are 30 days to change your mind; after that a daily job removes the workspace's records from the database for good. Copies inside backups age out within the 30 days that each backup is kept.
- Uploaded files. Files are stored apart from the database and that job does not remove them yet. When a workspace is deleted, we delete its files on request: email us.
What we don't have yet
- No SOC 2 or ISO 27001 certificate. Ancor has not been through a formal audit, and no outside firm has run a penetration test. The reviews so far have been our own.
- One region. The app and database run in Mumbai with no standby copy in another region. If Google Cloud or Supabase had a Mumbai-wide outage, Ancor would be down until it came back.
- Daily backups, not continuous. In the worst case, up to a day of entries could be lost. There is no point-in-time recovery today, and the backups sit in the same Google Cloud account as the app.
- Owners cannot yet require two-factor sign-in for their whole team. Each person turns it on for themselves.
- A one-person company. There is no on-call team around the clock. If something breaks at night, the founder fixes it when he sees the alert.
The paperwork
Ancor is a sole proprietorship: Rushabh Porwal, trade name Ancor, GSTIN 27CSNPP8704M1ZW, 102 Rajniketan, Bapubhai Vashi Road, Vile Parle West, Mumbai 400056. Our data processing agreement forms part of the terms and applies to every customer, with the EU Standard Contractual Clauses and the UK Addendum for agencies in the UK and Europe; email us for a countersigned copy. See also the subprocessors, the privacy policy and the terms.
Security questions
Questions about security, a security questionnaire, a countersigned data processing agreement, or a weakness you have found: write to the founder directly.