Loading…
TRUST & SECURITY
Security architecture and governance
What exists today, what's in progress, and who we share infrastructure with — stated plainly, not certified.
Identity & access
Access control for the institutional data plane.
In place today
- Server-side sessions with explicit revocation — signing out (or an admin action) invalidates a session immediately, not just on token expiry.
- An entitlement chokepoint that every data-plane request passes through — access is checked server-side against what an organization is actually entitled to, not inferred from the client.
- Route-scoped security headers (Content-Security-Policy, Cross-Origin-Opener-Policy) tailored to what each surface actually needs, not a single loose policy site-wide.
In progress
- Multi-factor authentication and single sign-on for institutional accounts.
- Database-level tenant isolation (row-level security) enforced at the database layer, in addition to the application-level entitlement checks that exist today.
Application security
Practices that run on every change to this codebase, not a point-in-time claim.
In place today
- Automated secret scanning on the codebase.
- CI gates that block a merge on failing tests or accessibility checks — a change doesn't ship past them.
- Encryption in transit (TLS) for all traffic to the site and its APIs.
- Server-side data-plane calls only — the browser is never handed direct venue or database access.
- Encryption at rest for the underlying database, provided by default at the infrastructure layer (Supabase-managed Postgres).
Compliance & operational readiness
Said plainly rather than left unmentioned — none of the following has started yet. This section exists so a diligence review doesn't have to guess at what isn't here.
Not yet started
- Audit logging for institutional data-plane requests.
- A documented incident-response and breach-notification process.
- An independent third-party penetration test.
- A business-continuity / disaster-recovery plan.
- SOC 2, ISO 27001, or any other third-party security certification.
Data governance
Every number we publish carries provenance — its source, an as-of time, and a methodology version — and delivery is entitlement-aware: what an organization can see is governed by what it's actually entitled to, checked on the server for every request. We don't publish data-retention numbers or an uptime/availability SLA here because none are measured or contractually committed yet — that follows the identity work above.
Subprocessors
Infrastructure providers with access to a defined slice of the data or the request path.
- Vercel — application hosting and edge network.
- Supabase — managed Postgres database.
- Sentry — error monitoring and diagnostics.
Security contact
Found an issue or have a question about our security posture? Email us directly, or see our full disclosure policy and scope below.
Have a security or diligence questionnaire?
Request institutional access and include your questionnaire — we'll respond directly.