How we protect your financial data.

Each customer runs in a single-tenant Postgres database with row-level security (Supabase). Your data is never co-mingled with another customer's data at the storage layer - every row carries an organization identifier and is enforced by Postgres policies, not just application code.

The application layer is hosted on Vercel, which runs on SOC 2 Type II-certified infrastructure (AWS). Our database provider, Supabase, is also SOC 2 Type II certified.

For customers who require it, we deploy into your private cloud or on-premise environment. The same single-tenant model applies; you control the keys, the network, and the boundary.

• In transit: TLS 1.2+ for all client-server traffic, including API calls and real-time channels.
• At rest: AES-256 encryption on all database storage and backups.
• Backups: Daily automated backups, retained for 30 days, encrypted at rest, restorable to any point in the retention window.
• Secrets & keys: Managed via Vercel + Supabase environment vaults. No secrets in source control. Rotated on personnel change.

• End-user auth: Email + magic link or OAuth (Google, Microsoft). SSO via SAML/OIDC available for enterprise plans.
• MFA: Enforced on all administrative access (GitHub, Vercel, Supabase, AWS, model providers).
• RBAC: Role-based access control enforced at the database row level via Postgres RLS policies. Field-level masking is applied per role for sensitive columns (salaries, vendor amounts) - so an analyst sees what they should see, and an executive sees what they should see, without separate data copies.
• Audit log: Every read and write of sensitive data is logged with user, timestamp, and action. Logs are retained for 90 days (longer on enterprise plans).
• Least privilege: Service accounts and integrations are scoped to the minimum permissions needed. Personnel access to production data requires a recorded justification.

The Nova assistant runs on Anthropic (Claude) in production. Two commitments:

1. Zero data retention. Every API call is made under the provider's zero-data-retention contract. Your prompts and outputs are not stored on the provider side, and are never used to train models.
2. You choose the provider. Anthropic is our production default. If your security or procurement team has approved a different model family, we route through it on request; if you require an in-VPC or self-hosted model (e.g. Llama on your infrastructure), we deploy that path instead. Any provider we engage on your behalf runs under the same zero-retention terms and is added to your sub-processor list with notice.

We never sell, share, or otherwise disclose customer data to any third party for model training or analytics.

• You own 100% of your data. Always. We process it under your instructions; we do not own it.
• Export anytime: CSV, Excel, or raw SQL dump on request. Most exports are self-service in the product; raw dumps are fulfilled within 5 business days.
• Deletion on request: Hard-deleted within 30 days of a written request, including from backups (we run a 30-day backup window for that reason).
• Termination: If you leave, you receive a full export and your data is destroyed within 30 days. No clawback on your data, ever.

We're an early-stage company; we're transparent about where we are.

• SOC 2: Not yet attested. All the controls a SOC 2 Type II audit verifies (single-tenant isolation, access logging, MFA, encryption at rest and in transit, audit trails) operate today. Formal Type I attestation is on the roadmap; a CAIQ v4 self-assessment is available now to support your security review.
• CAIQ v4 (Cloud Security Alliance): Our completed Consensus Assessments Initiative Questionnaire self-assessment is available to prospects on request. See the summary.
• GDPR: Customer data is processed under a standard Data Processing Agreement (DPA) on request. Sub-processors are listed below.
• Penetration testing: Third-party pen testing is on our roadmap. Internal security review is continuous.

We won't claim a certification we don't hold. If your procurement team needs something specific, email us - we'll be straight about whether we can meet it today, when we plan to, or whether we're not the right fit yet.

A small set of vetted vendors may process customer data on our behalf: our database and hosting providers, the AI provider behind the Nova assistant, error monitoring, and the HR or ERP connectors a customer chooses to connect. Each is bound by data processing terms, and none receives more data than its function requires.

View the full sub-processor list

Customers are notified at least 30 days in advance of any new sub-processor that would process customer data.

• Detection: Continuous monitoring on application logs, database logs, and infrastructure events.
• Notification: Affected customers are notified within 72 hours of confirmed incident detection (faster on critical incidents). GDPR-required notifications meet the 72-hour standard.
• Postmortem: A written postmortem is shared with affected customers within 14 days, including root cause, scope, and corrective actions.
• Documented runbook: We maintain an internal incident response plan (template based on NIST 800-61). Available to enterprise customers under NDA.

For security questions, or to request our CAIQ v4 self-assessment, DPA, or sub-processor list:

security@getnovaplan.com

Response commitment: 24 hours for general inquiries, 4 hours for suspected security incidents.

Reporting a vulnerability? See our vulnerability disclosure policy for scope, safe harbor, and response timelines.