CashSignal is built for businesses where cash flow accuracy isn't optional, and where the data behind that forecast is some of the most sensitive your business holds. We've architected security as a first-principle, not a feature added later.

Tenant isolation Every customer's data is isolated at the PostgreSQL layer through Row-Level Security (RLS) policies. This means tenant separation is enforced by the database itself, not just by application code. Even in the event of an application-layer bug, the database refuses to return another customer's data.

Sensitive integrations data, bank connections, OAuth tokens for QuickBooks Online, raw transaction history, forecast outputs, is not accessible from the browser at all. These tables can only be read or written through our authenticated backend service, which enforces company membership on every request.

Verified through testing Our access control isn't theoretical. We've verified database isolation through direct anonymous-access testing of every table: zero rows are accessible without authentication, and authenticated access is restricted to the customer's own company data only.

Encryption

• All data in transit uses TLS 1.2 or higher
• Data at rest is encrypted using AES-256 (Supabase managed encryption)
• Bank credentials are never stored by CashSignal. Plaid handles credential isolation directly with your financial institution.
• OAuth tokens for QuickBooks Online are stored server-side only, never exposed to the browser

Infrastructure

• US data residency (no international data transfer)
• Hosted on enterprise-grade infrastructure: Vercel (frontend), Render (backend), Supabase (database)
• Automated daily backups with point-in-time recovery
• Multi-factor authentication available on all customer accounts

Compliance

• AICPA §1.700.001 conformant access controls for accounting firm engagements
• IRC §7216 compliant for tax practitioner client data
• SOC 2 Type II attestation targeted June 2027
• GDPR and CCPA data deletion requests honored within 30 days

Questions about our security posture? Contact security@cashsignal.io.