Trust & security

TLS 1.3 in transit. AES-256 at rest in Postgres + Supabase Storage. Field-level secrets stored in Supabase Vault. HSTS with includeSubDomains and preload eligibility.

Supabase Auth with HTTP-only cookies and a double-submit CSRF token, asserted by every server action that changes state. Email-and-password sign-in is the default, with a one-time magic link offered on the same screen. Multi-factor authentication is not offered today: the product has no enrollment screen, no account here has a second factor, and an organisation cannot yet require one. Per-user TOTP and per-organisation enforcement are specified as planned work in our MFA runbook, and this page will say so once they ship.

Row-level security on every table that holds customer data. Dual-layer policies: organisation_id as the first predicate, then per-role refinement. Exercised in the release gate that every merge to main must pass, by more than 100 pgTAP suites running over 1,500 assertions directly against Postgres. These are our own tests; independent attestation is the SOC 2 auditor's scope.

Append-only compliance_audit_log with 7-year retention, enforced by a database trigger that rejects UPDATE and DELETE even from the service role. It records the actions listed in the in-app Action filter (client, policy, document, billing, workflow, training, rank-ladder and sign-in events) plus three reads: opening a compliance document, downloading one, and exporting the trail itself. It is not a universal read log; opening a client or policy record does not write a row. AI calls are recorded in a separate append-only table, ai_invocations, under the same 7-year retention.

Per-state retention engine for regulated insurance records, with a rule per US jurisdiction. Soft-delete on cancellation with a 30-day customer export window, then an encrypted cold export retained for the longest applicable regulatory horizon, typically 5 to 7 years for IUL and annuity records.

Daily managed Postgres backups, plus a tagged logical dump with a written restore recipe taken before every destructive migration. That is a standing rule in our engineering constitution, not a convention. Recovery is exercised in documented tabletop drills, available under NDA. Continuous point-in-time recovery is a planned upgrade and is not enabled today; the current recovery-point objective is the last daily backup.

Every merge to main passes a release gate covering type checking, lint, the full unit and database test suites, and an admin-client boundary check, with the output recorded in the pull request. Dependabot raises security-advisory PRs in real time and batches routine upgrades weekly. Automated dependency and static-analysis scanning is configured but currently runs only in a scheduled workflow that is suspended, so it is not part of that gate today.

Severity ladder published in our security runbook, with named roles and a written communications path. Sev-0 customer notification within 4 hours of detection, direct to the operator contact on file.