Your data, protected.
DecisionGraph is built on the principle of least privilege. Here's what that means in practice — and the technical details behind it.
Encryption in transit & at rest
Every page and API call travels over TLS (HTTPS). Your documents, decisions, and account data are encrypted at rest by our managed cloud database provider.
Row-level isolation
Your knowledge, decisions, history, and connected-system snapshots are scoped to your account. No other tenant can read them, and our own team cannot query around the isolation layer.
Scoped connections
OAuth links to QuickBooks, Shopify, and Square ask for read-only permissions. You approve each scope before any data flows, and you can disconnect anytime.
Optional two-step verification
Turn on email one-time codes for an extra sign-in step. Codes expire in 10 minutes, are limited to 5 attempts, and trusted devices can be remembered for up to 30 days.
Managed infrastructure
We run on modern managed cloud infrastructure with automated patching, backups, and monitoring. We do not host our own data centers.
You own your data
Delete a document, disconnect a system, or close your account and the associated data is removed. We do not use your data to train foundation models.
Technical details
For IT leads, security reviewers, and anyone who wants the specifics.
Authentication
- Supabase Auth with JWT-based sessions.
- Passwords hashed with bcrypt and never stored in plain text.
- Optional email one-time code (OTP) two-factor authentication via public.two_factor_codes and public.two_factor_devices.
- 2FA codes are SHA-256 hashed, expire after 10 minutes, allow 5 attempts, and trusted-device tokens expire after 30 days.
Database access control
- Every user-facing table has Row Level Security (RLS) enabled.
- Policies enforce auth.uid() = user_id for documents, document_chunks, entities, relationships, decisions, business_profiles, decision_dna, notifications, notification_settings, expert_sessions, decision_reviews, weekly_reports, provider_snapshots, and subscriptions.
- Sensitive tables (oauth_connections, two_factor_codes, two_factor_devices, user_security) are restricted to service_role access only.
Connected systems
- OAuth 2.0 connections to QuickBooks, Shopify, and Square use scoped, read-only permissions.
- Access and refresh tokens are stored server-side only and are not readable through the client API.
- Safe connection metadata is exposed through a SECURITY DEFINER function (public.get_my_oauth_connections) that returns only non-sensitive columns scoped to the calling user.
Storage
- Uploaded documents live in a Supabase Storage bucket with RLS policies restricting each object to its owning user's folder.
- Files are encrypted at rest by the storage provider.
Payments
- Billing is handled by Paddle. Webhook signatures are verified with HMAC before any subscription state is updated.
- Subscription records are stored in public.subscriptions with RLS scoped to the owning user.
Encryption & transport
- All traffic is served over TLS 1.2+.
- Database traffic is encrypted in transit and at rest by the managed database provider.
AI & data use
- We send your prompts and retrieved context to AI providers solely to generate your decision readouts.
- Your data is not used to train or fine-tune foundation models.
Have a specific security question?
We're happy to walk through our architecture, review access, or discuss a custom security assessment.
Formal SOC 2 Type II and ISO 27001 certifications are on the roadmap. Current controls are implemented as described above.