Security
How this is built and run
This page exists for the person whose job is to evaluate us before an institution signs anything. Every claim on it is verifiable, and the things we have not done yet are listed with the same directness as the things we have.
Architecture, in one paragraph
Standing Proof is a server-rendered web application. The browser never talks to the database: every read and write goes through application code running on the server, which enforces ownership on each query. The database additionally has row-level security enabled on every Standing Proof table with zero permissive policies: deny-by-default at the database’s own API layer, re-verified on both of our environments every month by the security review. There is no public API.
Tenant isolation
Every record carries its owner. Application queries filter on the authenticated user’s identity, and collaborator access (where a user invites a résumé professional into scoped parts of their evidence) passes through a single authorization chokepoint that returns not-found for anything outside an explicit, revocable, per-record grant. What has not been shared is never listed, previewed, or counted to the other party.
Authentication
Sign-in is by emailed one-time code or magic link through Supabase Auth. There are no passwords, which means there is no password database to breach, reuse, or phish against. Sessions are cookie-based and server-verified on every request.
Encryption
Traffic is TLS in transit. Data is encrypted at rest by the database provider (Supabase, AES-256), a provider guarantee that applies to every project on the platform, stated here as exactly that rather than as a control we operate ourselves.
The keys a business owner’s QuickBooks Online connection reads with are encrypted again by us before they are stored (AES-256-GCM, each bound to its business and company, under a key held only in the application’s environment), never shown to anyone, and used only to read.
Data residency
Everything we store lives in the United States: the database in AWS us-east-2 (Ohio), application hosting on Vercel with its primary region in US East. AI analysis is sent to Anthropic, a United States company; we do not pin the region where it is processed, and we would rather say so than claim it. The bot check runs on Cloudflare’s global network. Calls held in Standing Proof run on Daily and are served from US East, with recording and transcript storage switched off, so neither a recording nor a transcript is kept there or here.
Backups
Daily physical backups with seven-day retention, held by Supabase in us-east-2. Point-in-time recovery is not enabled, so the recovery point is up to twenty-four hours. Restore has not yet been rehearsed, and we would rather say so than imply a tested path. A deleted account stays in a backup until it is overwritten; a restore deletes again every account deleted since the backup was taken, from a list kept eight days for that.
Subprocessors
Eight, and the list is short on purpose. Each one exists because it does something we should not build ourselves. Plausible, our cookieless analytics, is listed on the privacy policy rather than here: it is loaded on the marketing site only, and never receives anything from inside the product.
| Provider | Role | What it processes | Region |
|---|---|---|---|
| Supabase | Database hosting and authentication | All application data at rest; sign-in email addresses | United States (AWS us-east-2, Ohio) |
| Vercel | Application hosting and delivery | Data in transit through the application; request logs | United States (primary region US East) |
| Anthropic | AI analysis, only when a user, a professional they invited, or our staff on their engagement or in a business its owner let them into invokes it; answers to a visitor's question in the site's question box; and the check of what a professional puts up for the board before it is public (SP-1000) | The specific posting or records sent for that one analysis; a business's month of records when its briefing is drafted (SP-1043), its ledger's wins when its capability statement is drafted (SP-1049), the one win a case study tells or a packet's twelve months of figures and chosen wins when that is drafted (SP-1053), and an RFP, contract or partnership's text when it is read, with the kept requirements and the most relevant wins when wins are suggested for it (SP-1054), and the facts a business's Owner's Advisor is given when someone asks it a question, as its owner chooses (SP-1066); a professional's profile text, photo, logo or opening for the board's check; API data is not used to train models | A United States company; we do not pin the region where a request is processed |
| Stripe | Subscription billing; payments to professionals, made on the professionals' own Stripe accounts (SP-985) | Payment details (never sent to or stored by us); subscription status; a gift's recipient name, address and message; the contact details on an invoiced quote; for a payment to a professional: the amount, its description, the client's email address, and whether it was paid, refunded or disputed | United States |
| Resend | Transactional email delivery | Recipient address, subject and body of every message we send: sign-in links, digests, booking confirmations, a business's weekly brief (SP-1035), an invitation to a business's team (SP-1061), a business's credit on a win (SP-1063), what a business's team member is given and their Monday list of it (SP-1065), and what a professional sends a client through us (requests to pay, refunds, agreements to sign) | United States |
| Cloudmersive | Malware scanning of uploaded files | The complete contents of every file attached to a proof record or to a business's win (SP-1039), or shared between a client and a professional (SP-1011), at upload time | United States |
| Cloudflare Turnstile | Bot check on the booking form, the contact form, the affiliate application, the newsletter sign-up and the question box | Signals from the visitor's browser, including the IP address, when one of those forms is opened | Cloudflare's global network |
| Daily | Video calls held in Standing Proof, and their live transcript when everyone on the call agrees | The audio and video of a call while it runs and the names of those on it; when everyone agrees, the words spoken, transcribed live by Daily's speech provider. Recording and transcript storage are switched off, so Daily keeps neither; on a call with EPS about working together, we keep the transcript ourselves when everyone agrees | United States (calls served from US East) |
AI calls carry only what that one analysis needs, a job posting or the records a user chose to have read, and never the whole account, and users can mark any record as excluded from AI entirely. Anthropic does not train models on API data.
A service a business owner connects, QuickBooks Online, is not on the list either: we read from it at the owner’s direction, and send it nothing of theirs to process.
Retention and deletion
Data is kept while an account exists and deleted when the account is deleted: self-service, from Settings, no email required. What survives is small, and none of it is your record: an audit note that a staff member performed an action, kept because an audit trail that can be deleted is not one; the amounts and dates of anything you bought, with your name and details replaced; and a few records keyed to an internal account number, each listed with its reason. The full detail, including what happens to collaborator access on deletion, is in the privacy policy.
Internal access
Production access is limited to the founder. Staff support tooling operates through the application with every mutation written to an audit trail (who, what, when) rather than through direct database access.
What is not in place yet
No SOC 2, no third-party penetration test, no formal SLA. If your procurement requires any of these today, we are not the right tool yet, and we would rather say so here than midway through your review. Each sits on a staged readiness roadmap with explicit triggers: certification follows the first engagements that require it, and we will not claim it in advance.
Data processing agreement
A standard DPA covering the subprocessors and measures on this page is available on request for institutional engagements. Aggregate-only cohort reporting, where programs see counts and never participant records, is described on the data & trust page.
Questions a reviewer needs answered: privacy@standingproof.com.