Security Policy

All customer data is encrypted at rest using AES-256 and in transit using TLS 1.3. Secrets such as API keys and webhook signing secrets are stored encrypted (AES-GCM), never in cleartext.

Access to the Service is governed by role-based access control. Tenant isolation is enforced in the database itself via PostgreSQL row-level security with SECURITY DEFINER helpers. Administrative access to production is limited, logged, and protected by multi-factor authentication.

The Service maintains an enforced, append-only audit trail of sensitive actions. We employ error monitoring and continuous automated dependency and secret scanning in our CI pipeline on every commit.

We maintain a documented incident-response runbook with defined severity levels. Material incidents affecting customer data are communicated to affected customers without undue delay, and operational status is published on our status page.

We welcome reports from security researchers. Email security@unfoldingvalues.com with details. We operate a 90-day responsible-disclosure policy: we will acknowledge your report within 2 business days, work with you on remediation, and ask that you give us up to 90 days to remediate before public disclosure. We will not pursue legal action against good-faith research conducted under this policy.

We are pursuing SOC 2 Type II. Target report date: [TARGET DATE — placeholder]. Our controls are mapped to the Trust Services Criteria today, and we will make our report available to enterprise customers under NDA once issued.

Current subprocessors (last updated 2026-05-28): Supabase (database, authentication, storage); Vercel (application hosting); Resend (transactional email); Sentry (error monitoring, enabled only when configured). The current list is published on our Security page.