Security

Saevel handles sensitive financial data -- bank transactions, EINs, invoices, donor records, AI-generated tax suggestions. This page describes the controls we put in place to protect it.

Encryption

• In transit: TLS 1.3 on every request between your browser and Saevel, and between Saevel and every sub-processor.
• At rest: AES-256 for the Postgres database (managed by Supabase) and Supabase Storage. Integration tokens (QuickBooks, Quiltt, etc.) are additionally application-layer encrypted before being written to the database.
• Backups: daily encrypted snapshots, retained 30 days.

Tenant Isolation

Every database row carries an entity_id. Postgres Row-Level Security (RLS) policies on every table enforce that one entity's data is invisible to another, even at the database layer -- so a bug in application code can't leak across tenants.

Authentication

• Passwords stored as bcrypt hashes via Supabase Auth.
• Sessions are httpOnly cookies, short-lived, refreshed server-side.
• Role-based access within each entity: owner / accountant / editor / viewer.

Integration Tokens

• OAuth tokens (QuickBooks, Xero) are stored encrypted and rotated automatically via refresh tokens.
• Webhook signatures are verified for every inbound webhook (HMAC-SHA256, 5-min timestamp window).
• API keys (Stripe, HighLevel PIT) are restricted-scope where the provider supports it.

AI Privacy

Anthropic Claude is used for transaction categorization, receipt OCR, invoice OCR, and audit suggestions. Anthropic's API provides zero data retention -- they do not train on your data, and they do not retain your prompts. We send only the minimum data needed for each call (a single transaction or document at a time, not your full ledger).

Infrastructure

• Hosted on Vercel (SOC 2 Type II) and Supabase (SOC 2 Type II, HIPAA-eligible).
• Production secrets stored in Vercel encrypted environment variables; never committed to git.
• Audit logging on every transaction modification: who changed what, when, from what value.

Reporting a Vulnerability

Found a security issue? Please email sara@sparkdigitalinc.com with details. We respond within one business day and don't pursue legal action against good-faith researchers.