Security is enforced at every data boundary.

• Supabase Auth manages password hashes and signed sessions; ProofRows cannot read passwords.
• Database row-level security scopes records to the signed-in user, organization membership, and client assignment.
• Viewer access is read-only. Transaction changes use atomic audited procedures, and the database rechecks the acting member’s write role.
• API keys are stored as hashes, organization-scoped, rate-limited, and shown only when created.

• Statement and receipt buckets are private. Source previews use document-specific signed URLs that expire after 60 seconds.
• Files are transmitted over TLS and encrypted at rest using the storage provider’s standard encryption.
• Source files are removed after the configured retention period; structured records and immutable edit/export history remain until the related record or account is deleted.
• Financial descriptions, vendors, filenames, amounts, balances, document text, and raw provider errors are excluded from application telemetry.

• Generated export files are streamed to the requester instead of being retained by ProofRows.
• Each completed export gets a permanent proof snapshot with its SHA-256 digest and reconciliation result; authenticated clients cannot forge or rewrite those records.
• QuickBooks OAuth tokens are available only to server routes and must be sealed with AES-256-GCM before the integration can be enabled.
• The extraction provider receives the source document for OCR and OCR text for parsing. Provider retention, region, training, and DPA settings must be verified and controlled at the operator account level.

• Account deletion requires the exact account email, a fresh password verification, and an explicit confirmation phrase.
• Deletion is blocked while a workspace is shared so another member’s records cannot disappear through an ownership cascade.
• Database recovery depends on the provider backup/PITR capability enabled for the production project. We do not represent point-in-time recovery as active unless it has been verified.

We do not currently claim SOC 2, ISO 27001, PCI DSS, or HIPAA certification. No online service can promise that it will never be compromised. We review dependencies, access policies, deployed headers, secrets, and database privileges before releases and plan independent penetration testing as the service scales.

More detail appears in our Privacy Policy and Data Processing Addendum.

Email security@proofrows.com. Please include the affected URL, reproduction steps, impact, and a safe way to contact you. Do not access another customer’s data, disrupt service, or publish details before we have a reasonable opportunity to investigate and fix the issue.

Our machine-readable coordinated-disclosure contact is at /.well-known/security.txt.