Trust & security

Data is encrypted in transit and at rest, as provided by our hosting providers. Field-level secrets stored in Supabase Vault. HSTS with includeSubDomains and preload eligibility.

Supabase Auth with HTTP-only cookies and a double-submit CSRF token, asserted by every server action that changes state. Email-and-password sign-in is the default, with a one-time magic link offered on the same screen. Every account must set up and verify an authenticator app (TOTP) before accessing the private application. Subsequent sign-ins require an authenticator code. Users can add a second app in Security settings; lost-device recovery requires identity verification by an authorized operator.

Row-level security on every table that holds customer data. Dual-layer policies: organisation_id as the first predicate, then per-role refinement. Exercised in the release gate that every merge to main must pass, by more than 100 pgTAP suites running over 1,500 assertions directly against Postgres. These are our own tests; independent attestation is the SOC 2 auditor's scope.

Append-only compliance_audit_log with 7-year retention, enforced by a database trigger that rejects UPDATE and DELETE even from the service role. It records the actions listed in the in-app Action filter (client, policy, document, billing, workflow, training, rank-ladder and sign-in events) plus three reads: opening a compliance document, downloading one, and exporting the trail itself. It is not a universal read log; opening a client or policy record does not write a row. AI calls are recorded in a separate append-only table, ai_invocations, under the same 7-year retention.

Per-state retention engine for regulated insurance records, with a rule per US jurisdiction.

Daily managed Postgres backups, plus a tagged logical dump with a written restore recipe taken before every destructive migration. That is a standing rule in our engineering constitution, not a convention. Recovery is exercised in documented tabletop drills, available under NDA. Continuous point-in-time recovery is a planned upgrade and is not enabled today; the current recovery-point objective is the last daily backup.

Every merge to main passes a release gate covering type checking, lint, the full unit and database test suites, and an admin-client boundary check, with the output recorded in the pull request. Dependabot raises security-advisory PRs in real time and batches routine upgrades weekly. Automated dependency and static-analysis scanning is configured but currently runs only in a scheduled workflow that is suspended, so it is not part of that gate today.

Severity ladder published in our security runbook, with named roles and a written communications path. Sev-0 customer notification direct to the operator contact on file.