Security
This page lists controls that are currently implemented in the product, as well as items that are planned. We separate the two so you can make accurate decisions.
Currently Implemented
Authentication
Managed Supabase Auth. Individuals can sign up openly with email or Google; the firm/team portal still requires an invitation.
Authorization
PostgreSQL Row-Level Security (RLS) on user data; owner / staff visibility model for cases, folders, beneficiaries, notifications, and billing.
Privileged data isolation
Notification delivery records are service-role only and never readable by end users. Recipient identifiers are stored in masked form.
Payments
The personal version is free and collects no card data. For paid services, card data is processed and stored by Stripe; we store only Stripe identifiers and subscription state.
Transport security
HTTPS/TLS in transit via the managed hosting platform.
Scheduled jobs
Internal cron endpoints require a rotated shared secret.
Idempotency
Notification event fingerprints prevent duplicate delivery across concurrent manual/cron refreshes within a bounded window.
Data export and deletion
Signed-in users can request an account data export and self-serve account deletion under Settings → Data & privacy (cancellable, scheduled at least 30 days out).
Abuse controls on public endpoints
Support contact submissions are rate limited atomically at the database level; rate-limit keys are hashed with a server-side pepper so raw IPs are never stored.
Planned
Detailed audit log surfaces for team accounts.
SSO / SAML for enterprise customers.
Formal external attestations (e.g. SOC 2). We do not currently claim these.
Shared Responsibility
Managed platform capabilities are provided by the underlying hosting, database, and payments vendors. Application controls (RLS policies, entitlement checks, endpoint auth) are our responsibility. Your responsibility includes protecting your credentials, keeping invite links private, and configuring notification channels correctly.
Responsible Disclosure
If you believe you have found a security issue, please report it via the contact form. Include steps to reproduce and any relevant scope. Please do not include real end-user credentials or sensitive personal data in your report.