Security
Built the way an examiner would ask for it.
Tenant isolation at the database, records that cannot be edited after the fact, encryption everywhere, and access controls your firm can audit.
Four controls that do the work.
Most of what protects your data is enforced below the application, where a bug in our code cannot reach it.
Tenant isolation enforced by the database.
Every table that holds customer data has row-level security in Postgres. Application code cannot cross a tenant boundary by accident because the database refuses the query.
Append-only records.
Compliance checks, audit logs, content approvals, email sends, and CRD sync events are insert-only. Database triggers reject UPDATE and DELETE for every role, including the service role.
Encryption in flight and at rest.
TLS 1.3 for every connection. AES-256 for sensitive fields such as OAuth tokens and integration credentials. Postgres-managed encryption for the database tablespace.
Sessions and access.
TOTP multi-factor authentication on every account. Sessions refresh on a one-hour cycle. Administrative impersonation is read-only, limited to 30 minutes, and fully logged.
Posture and vendors.
Where we are today, stated plainly. This table is updated as each item changes.
| Item | Status |
|---|---|
| SOC 2 Type 1 | Readiness assessment in progress. |
| Penetration testing | Annual third-party test, first one scheduled before launch. |
| Subprocessors | Supabase (US East 2), Vercel, Anthropic, Resend, Cloudflare, Stripe. |
| Data export | Available on request for the full tenant. |
| Account deletion | Tenant data is zeroed within 30 days of a deletion request. |
| Firm identity | SAML 2.0 single sign-on and SCIM provisioning on the Firm plan. |
- SOC 2 Type 1
- Readiness assessment in progress.
- Penetration testing
- Annual third-party test, first one scheduled before launch.
- Subprocessors
- Supabase (US East 2), Vercel, Anthropic, Resend, Cloudflare, Stripe.
- Data export
- Available on request for the full tenant.
- Account deletion
- Tenant data is zeroed within 30 days of a deletion request.
- Firm identity
- SAML 2.0 single sign-on and SCIM provisioning on the Firm plan.
Questions a security questionnaire would ask?
Firm pilots include a written response to your due-diligence questionnaire.