Your client’s data, defended.
Calibrated honesty: here’s exactly how Unlevered stores, protects, and reasons about client information. We update this page when something changes.
Encrypted
AES-256 at rest, TLS 1.3 in transit.
US-East
All data stays in the US.
Default deny
RLS enforces firm-scoped access.
Audit-logged
Material actions hashed and tracked.
Encrypted at rest, in transit, end to end.
Primary application data sits in Supabase Pro on AWS infrastructure, US-East regions. Object storage (uploaded client documents and photographs) lives in S3, US-East. No data leaves the United States.
- Database encryption: AES-256 at rest, full-disk on managed Postgres
- Transit encryption: TLS 1.3, HSTS preloaded
- Backups: encrypted daily backups on managed infrastructure
- Object storage: server-side encryption, signed-URL only access, no public buckets
Default-deny, role-checked, firm-scoped.
Row-level security is on for every table. The default policy is deny — if a query doesn’t prove it belongs to your firm and role, the database refuses to return rows. We test this on every deploy.
- Password or Google sign-in with TOTP multi-factor authentication on the professional side
- Email-verified access on the client side, scoped to a single study — delivered reports require a one-time code sent to the client’s on-file email
- Role separation: CPA, firm admin, client, platform admin
- Platform-operator access is limited to named, MFA-enforced admins, and every operator action is written to the audit log
- Production database changes require code review, peer approval, and a change record
Every material action logged.
Engine runs, classifications, review overrides, document uploads, payment events, and access grants are all written to an immutable PlatformEvent stream. The stream is append-only at the database layer — rows cannot be edited or deleted — and every engine run carries a content hash binding its inputs to its outputs.
- Engine-run reproducibility: a hash binds inputs to outputs, so studies can be re-run identically
- Engineer review trail: who reviewed, when, what was changed, why
- Source provenance: every classification ties back to a citation row
- Exportable archive: every study can be exported with its full audit trail
Who else touches the data.
We name every subprocessor that handles client data, what they handle, and where. Updates are pushed to the DPA and emailed to admins.
Detailed subprocessor commitments live in the Data Processing Addendum. We post 14-day notice before adding a subprocessor that touches customer data.
What we keep and for how long.
- Active client data: retained while the relationship is active.
- Engagement records (delivered studies, workpapers, source documents, audit trail): at least 7 years from delivery, matching IRS audit windows and our engagement letters; delivered studies may be retained beyond that so clients keep access.
- Audit logs: append-only; retained at least 7 years.
- Cancelled accounts: access disabled immediately; account data soft-deleted from active systems. Engagement records and audit ledgers keep their retention windows above.
- Sentry error reports: anonymized — PII scrubbed before send.
Found something? Tell us.
We respond to disclosure reports inside 48 hours. No-retaliation policy. We’ll work with you on a coordinated public timeline if applicable.
Encrypt sensitive details with our PGP key, available on request.
hello@unlevered.ioWhat we don’t claim. We don’t carry cyber liability insurance at MVP. We don’t guarantee audit defense. We don’t hold a SOC 2 report yet (the audit is scheduled). We say what we do, plainly, and we’ll update this page the day anything changes.