Security Practices

RevCollect is built for bookkeepers and finance teams who trust us with sensitive client data. This page describes the controls we implement today and our roadmap. We do not hold SOC 2 certification yet; we target SOC 2 Type I in months 12–18.

• All traffic uses TLS 1.2 or higher.
• Database storage is encrypted at rest (Supabase).
• Email bodies are encrypted at the application layer before storage (AES-256-GCM).

Every database row is scoped to a workspace tenant_id. Row Level Security in PostgreSQL enforces isolation even if application code has a bug. Authentication is handled by Clerk Organizations; database credentials never reach the browser.

We use Anthropic and OpenAI commercial APIs for inference only. Customer data is sent as prompt context for a single request and is not used to train or fine-tune models. We do not log full email bodies to analytics or error-tracking systems.

Access to personal data (viewing email threads, exports, deletions) is recorded in an append-only audit log with actor, timestamp, and resource identifier.

Cancelled workspaces are purged within 30 days. Email content older than 24 months is automatically purged unless you opt out. See our Privacy Policy for details.

We commit to notifying affected customers and supervisory authorities within 72 hours of becoming aware of a personal data breach, where required by GDPR, CCPA, or Australian privacy law.

We schedule third-party penetration testing starting in month 6 after launch.

Security inquiries: security@revcollect.app