How we protect your data
Enterprise-grade security infrastructure protecting your most sensitive business, financial, and governance data. Built for founders who demand institutional-level trust.
What's in place today
Encryption
Data encrypted at rest with AES-256 and in transit with TLS.
Certified hosting
Hosted on SOC 2 Type II certified cloud infrastructure.
Row-level security
Every record is isolated per business at the database level, so one customer can never read another's data.
SOC 2 Type II
Our own SOC 2 Type II audit is planned.
ISO 27001
ISO 27001 certification by an accredited auditor is planned.
How we protect your data
Multiple layers of security, from encryption at rest to real-time monitoring, ensure your data remains safe.
AES-256 Encryption & HSTS Preload
All data encrypted at rest using AES-256 and in transit using TLS 1.3. HSTS with preload directive (max-age=63072000) enforces HTTPS across all connections — no fallback to HTTP. Your financial data is protected with the same encryption used by leading financial institutions.
Isolated Data Architecture
Each account operates in logically isolated database environments with Row Level Security (RLS) policies ensuring no cross-tenant data access.
Multi-Factor Authentication
OAuth SSO via Google and Apple, with optional TOTP-based MFA. Session management with automatic timeout and device tracking.
PII Masking & Access Controls
Sensitive data (emails, phone numbers, financial details) is automatically masked for non-owner roles. Role-based access control ensures least-privilege access.
Enterprise Cloud Infrastructure
Hosted on enterprise-grade cloud infrastructure operated by SOC 2 Type II–certified providers. Automatic backups, disaster recovery, and continuous monitoring. Our own SOC 2 Type II audit is planned.
Rate Limiting & Bot Protection
Server-side rate limiting on all API endpoints and edge functions. Configurable per-user and per-IP throttling with automatic 429 responses. Bot protection via robots.txt directives and request signature validation.
Security Headers & Transport
Strict-Transport-Security with preload, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers enforced on all responses.
Audit Logging & Monitoring
Comprehensive audit trail for all user actions, data changes, and access events. Automated anomaly scans across finance and operations with alerting for suspicious activity. security.txt published at /.well-known/security.txt for responsible disclosure.
Have security questions?
We're happy to provide our security documentation, complete a vendor security questionnaire, or schedule a call with our security team.
Ready to get started?
Start your 14-day trial with full security features from day one.