The honest answer to "is this safe?"
We're pre-revenue, so we haven't spent on a SOC 2 yet — but every architectural decision has been made as if we were about to. Here's exactly what we do today, what we don't, and what's coming.
How your data is stored.
Six facts about where your data lives, how it's encrypted, and what we never touch.
Postgres + Auth + Storage. Data does not leave US infrastructure.
HSTS enabled; HTTPS-only on every route, including marketing.
Provided by Supabase Postgres + Storage at the infrastructure layer.
Every multi-tenant table carries row-level security policies keyed off the authenticated business. No service-role queries in user-facing routes.
OperatorOS stores only the Stripe customer ID. We never see, log, or persist card numbers.
Supabase Auth session cookies are first-party and functional. No third-party tracking cookies.
What audits we have today.
That's the honest answer. SOC 2 Type II, ISO 27001, and HIPAA-readiness are scoped for the post-revenue roadmap — buying a Type I report before there's a real customer to attest to is theater, and we don't do theater.
Until then, we publish the threat model below, ship every multi-tenant query through RLS, and respond to security reports within 72 hours. The first customer who needs a Type II report is the trigger to start the auditor engagement.
Threat model — by surface.
The full per-route version lives in our repo at docs/security/threat-models.md and is available to enterprise prospects on request. Six load-bearing examples here.
/api/waitlist
Spam signups, enumeration.
Email-shape validation, service-role isolated. Vercel WAF rate-limit rule documented as a pre-launch action.
/api/billing/webhook
Forged Stripe events, metadata spoofing.
HMAC signature verification; business resolved by `stripe_customer_id`; metadata `business_id` must match the DB row before any subscription update.
/api/cron/reminders
Bearer-secret leak triggering mass sends.
Rotatable `CRON_SECRET`; Vercel `vercel-cron` UA gate; admin client scoped to this route only; Authorization header never logged.
/api/ai/compliance-insights
Parallel requests exceeding LLM cost budget.
Atomic `try_consume_ai_rate_limit` RPC with advisory transaction lock; per-tier window cap; gated to Business plan.
/share/[token] · /accountant/[token]
Token guessing or unauthorized portal access.
128-bit random hex tokens, revocable from settings, view-counted with IP-hashed access log, 90-day expiry on accountant magic links.
Document storage
Cross-tenant file access (IDOR).
Supabase Storage RLS policies + ownership check before generating signed URLs; signed URLs are short-lived.
Found something? Tell us.
We acknowledge security reports within 72 hours and triage within 5 business days. We will not pursue legal action against researchers who follow this policy: report privately first, give us a reasonable window to fix, no destructive testing on production data, no social engineering of our team or customers.
No bug bounty program yet — but a thank-you in the changelog and an enterprise demo on the house if you find something real.
Who else touches your data
The third-party services we use to operate OperatorOS. Where applicable for healthcare customers, each is required to sign a Business Associate Agreement (HIPAA §164.504(e)).
| Vendor | Role | Data class | BAA |
|---|---|---|---|
| Supabase | Postgres + Auth + Storage | All customer data | Required for healthcare customers — Supabase Pro/Team plan supports BAA. Status: PENDING. |
| Resend | Transactional email | Recipient email + reminder body | Required for PHI-bearing reminders. Status: PENDING. |
| Anthropic | AI compliance insights (Claude Haiku) | Business profile + tracked deadline names | Available via Claude on Bedrock or direct agreement. Status: PENDING. |
| Twilio | SMS reminders (optional) | Recipient phone + reminder body | Required if SMS enabled for PHI-bearing customer. Status: PENDING. |
| Stripe | Subscription billing | Customer name, email, payment method | Stripe does not consider billing metadata PHI. Status: N/A. |
| Vercel | Hosting + edge functions | Request transit (TLS-terminated; no app-layer persistence) | Vercel Enterprise BAA available. Status: PENDING. |
“Status: PENDING” means the BAA is required before healthcare customers can ingest PHI through OperatorOS and is actively being negotiated. Healthcare-vertical onboarding is gated on full coverage of every PENDING row above.