This week: Breach-Season Shield · Defender $399 → $299Live in 72 hoursZero sales callsBacked by a written refundThis week: Breach-Season Shield · Defender $399 → $299Live in 72 hoursZero sales callsBacked by a written refundThis week: Breach-Season Shield · Defender $399 → $299Live in 72 hoursZero sales callsBacked by a written refund
Honest Comply

Security

Security at Honest Comply

What we do, what we use, and who has access.

Encryption

At rest: Supabase Postgres (AES-256) and Supabase Storage. In transit: TLS 1.2+ enforced via Vercel and Strict-Transport-Security headers. Storage buckets are private; downloads use short-lived signed URLs (7-day expiration by default, rotatable).

Access control

Postgres row-level security is enforced on every customer-scoped table. The portal authenticates via Supabase Auth with magic-link email. Service-role keys are never sent to the browser and are stored only in Vercel environment variables.

Sub-processors with BAAs

  • Supabase (database, storage, auth) — BAA on file
  • Stripe (billing) — BAA on file
  • Resend (transactional email) — BAA on file
  • Vercel (hosting, cron) — BAA on file
  • Anthropic (AI summary generation) — DPA + Zero Data Retention

Webhook hardening

Every inbound webhook (Stripe, GHL) is signature-verified and idempotency-checked via the webhook_log table. Replay attacks fail the signature check or short-circuit on the dedupe key.

Backups + retention

Supabase provides automatic daily backups with point-in-time recovery on the production tier. We retain training completion records and immutable audit logs for six years, in line with HIPAA documentation requirements (45 CFR 164.530(j)(2)).

Reporting a vulnerability

Email security@honestcomply.com with a description and repro steps. We acknowledge within 24 hours and aim to remediate high-severity issues within 7 days.