Trust centre
Last updated: October 26, 2026
An agency that moves to Ancor hands over its client list, its invoices, its team's hours and sometimes salaries. Everything you need to check before you do that is linked from this page, including what Ancor does not have yet.
The documents
The short version
| Who runs Ancor | Rushabh Porwal, a sole proprietor trading as Ancor, in Mumbai, India. One person today. |
| Where your data is | The app, database, AI, uploaded files and backups are in Mumbai, India. A cache, email sending and error reports run elsewhere; see subprocessors. |
| Encryption | HTTPS everywhere; provider disk encryption at rest; salaries, connected-tool tokens and two-factor secrets encrypted again by Ancor with AES-256. |
| Backups | Daily, kept 30 days, restore tested on 23 October 2026. |
| If something goes wrong | We tell affected agencies within 48 hours of finding a personal data breach. |
| Leaving | Export everything from Settings any time. Ask for deletion and, after a 30-day window, the workspace is removed. For now, uploaded files are deleted on request. |
| Certificates | None. No SOC 2, no ISO 27001, no outside penetration test. |
Status and uptime
There is no public status page yet. Google Cloud checks the API every 5 minutes, and an outage or a spike in errors sends the founder an email alert. You can see the same health check yourself at getancor.com/api/health: it answers "ok" while the service is up.
We do not offer an uptime guarantee or a service level agreement.
What we don't have yet
- No SOC 2 or ISO 27001 certificate, and no penetration test by an outside firm.
- One region (Mumbai) with no standby, and daily rather than continuous backups.
- No 24-hour on-call team: Ancor is one person.
The full list, with detail, is on the security page.
Ask us
Security questionnaires, a countersigned DPA, a request to join the subprocessor list, or a weakness you have found: write to the founder directly.