Data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest. Access to production is least-privilege and uses multi-factor authentication. If an incident affects personal or financial information, affected customers are notified. Those controls are named in the privacy policy, section 6 (Security Standards).
Tokens are deleted when QuickBooks is disconnected or the account ends. Synced financial data leaves production within 30 days. Backups may keep a copy for a limited time. See the privacy policy, section 5 (Data Retention, Disconnection, and Deletion).
Vercel hosts the application. Supabase hosts the database and authentication. The privacy policy section 4 names both.
Changes go through pull request review, and dependency alerts are tracked.
Current status is published at status.clayrfi.ai.
The SOC 2 program is underway.
Email [email protected]. That mailbox is the published Privacy & Security contact.