SOC 2 controls, GDPR-grade data handling, row-level security in the database, audit logs on every action, and an optional HIPAA Business Associate Agreement for healthcare clients.
Every protected table has RLS policies. A buggy frontend cannot leak data — the database refuses to return it.
Access reviews, password policy, MFA on admin accounts, vendor risk reviews, and incident response procedures.
Foreign-contractor tax forms collected at onboarding, version-controlled, and exposed to clients on the application detail page.
Role changes, payment events, contract signatures, and admin overrides are all permanently logged with actor + timestamp.
TLS 1.2+ everywhere, AES-256 at rest, signed URLs for asset downloads (1-year max TTL).
Available for healthcare clients on request. Contractors handling PHI complete HIPAA training before their first shift.
We have a standard security questionnaire and architecture diagram ready to share under NDA.
Request security pack