Security
You send us a supplier you are about to spend money with, and sometimes a document you were given in confidence. Here is what happens to it.
Your data is separated at the database level
Client data is partitioned so that one client's cases cannot be reached from another client's account. That separation is enforced by row-level security in the database itself, not by a check in application code that a bug could bypass.
The rule fails closed. If a request cannot be positively matched to your account, it returns nothing rather than defaulting to more.
Uploaded files are scanned
Documents you upload are scanned for malware before they are processed or stored.
Encryption
Data is encrypted in transit. Payment card details never reach our systems — card processing is handled by Stripe, and we do not store card numbers.
Who can see your case
Access is limited to the people who need it to produce and review your report, and administrative access is granted by named capability rather than by a general staff login. Sign-in is handled through a managed identity provider rather than passwords we store ourselves.
Quality control before delivery
Every report passes a review step before it is released. That is quality control rather than security, but it means nothing reaches a client unchecked.
What we would tell you
If something went wrong that affected your data, we would tell you. We are a small company and that is a commitment about conduct rather than a compliance certification — we do not hold SOC 2 or ISO 27001, and we are not going to imply otherwise.