Exterior Consigliere ← Back to site

Security & Subprocessors

Last updated 2026-07-28

The short version. Your customer list is your business, so we treat it that way. Every company's data is isolated at the database level, not just in the app. Card numbers never touch our servers. We don't sell your data, we don't run ad trackers, and nothing you store is used to train AI models.

Tenant isolation — the important one

Every record in the database carries the ID of the company that owns it, and row-level security is enforced by the database itself: a query authenticated as your company physically cannot return another company's rows. This is not a filter in application code that a bug could skip — the rule lives in Postgres, below the app.

Ownership is stamped automatically on insert by a database trigger, so a record can't be created unassigned or assigned to someone else. Uploaded documents and photos are stored in a private bucket partitioned per company, with access policies scoped to that company's folder.

Accounts & access

Authentication is email + password, handled by our database provider's managed auth service. Passwords are salted and hashed by that service; we never see or store them.
Sessions use short-lived access tokens with refresh, so a stale token stops working.
Each company controls its own users and invites; access is removed as soon as a user is removed.
Access to production systems is limited to authorized personnel and used only to operate and support the Service.

Transport & browser hardening

All traffic is HTTPS/TLS. Data is encrypted at rest by our database and storage provider. The application additionally ships with enforced browser-level protections:

Control	What it does
HSTS `max-age=31536000; includeSubDomains`	Browsers refuse to connect over plain HTTP, including on subdomains
Content-Security-Policy (enforcing)	Scripts may load only from our own origin and our mapping provider — blocks injected/third-party script execution
`frame-ancestors 'none'` + `X-Frame-Options: DENY`	The app cannot be embedded in another site (clickjacking)
`X-Content-Type-Options: nosniff`	Blocks MIME-type confusion attacks
`object-src 'none'`	No plugin/embed content can execute
Permissions-Policy	Microphone and payment APIs disabled outright; camera and location available only to the app itself, and only with your browser's permission
Referrer-Policy	Limits what address information leaks to external sites

Payments

Subscription billing runs through Stripe. Card details are entered directly into Stripe and never pass through or get stored on our servers — we hold only a customer reference and subscription status. Stripe is certified PCI DSS Level 1, the highest level defined by the card networks.

AI features and your data

Some features send content you choose to submit (for example a job note, or a photo you ask us to assess) to Anthropic's Claude API to generate a result that comes back to you.

Your data is not used to train AI models. This is committed contractually in our DPA.
Only the content needed for the specific request is sent — we don't bulk-upload your database.
AI features are optional. Core work — contacts, jobs, measurements, estimates, invoicing — runs without them.

Subprocessors

We use a small set of established providers to run the Service. Each receives only what it needs for its function. This list mirrors the one in our Privacy Policy; we give notice of material changes as described in the DPA.

Provider	Function	Data it touches	Provider's own compliance
Supabase	Database, authentication, file storage	Account and service content, credentials, documents and photos	SOC 2 Type II
Vercel	Application hosting and API	Request data in transit; operational logs	SOC 2 Type II
Stripe	Subscription billing	Billing details and card data (we never store cards)	PCI DSS Level 1, SOC 2
Google	Maps, geocoding, roof imagery and measurement	Property addresses and coordinates	SOC 2/3, ISO 27001
Anthropic	AI features	Content you submit for AI processing (not used for model training)	SOC 2 Type II
Cloudflare	DNS and inbound email routing	DNS queries; inbound email metadata and contents	SOC 2 Type II, ISO 27001
Email delivery (SMTP)	Transactional, estimate and follow-up email	Recipient name and email, document links	—

Compliance status in the right-hand column belongs to each provider and is maintained by them, not by us. Follow the links for their current attestations.

Data retention and deletion

You can export your data at any time while your subscription is active. After cancellation, data is held for roughly 60 days and then permanently deleted, except where law or an active legal hold requires otherwise. During that window you can request an export or written confirmation of deletion. Full terms are in the Terms of Service.

Incident response

If we confirm a breach affecting your data, we will notify you without undue delay and in any event within 72 hours, with the information available to help you meet your own notification obligations. See DPA section 6.

Tracking

We use only the cookies and local storage needed to keep you signed in and run the app. No third-party analytics, advertising, or tracking technologies. We do not sell personal information or share it for cross-context behavioral advertising.

Certifications — what we have, and what we don't

We are not currently SOC 2 or ISO 27001 certified, and we won't imply otherwise. Those are formal third-party audits appropriate to a larger organization, and we would rather be straight with you than post a badge we haven't earned.

What is true: the infrastructure your data actually lives on — Supabase, Vercel, Stripe, Google, Anthropic, Cloudflare — is operated by providers who each maintain SOC 2 and comparable programs (see the table above), and the controls described on this page are implemented and in force today.

If your organization requires a formal audit report as a condition of purchase, tell us. We'll give you a straight answer about timing rather than a maybe.

HIPAA

The Service is not designed for protected health information and should not be used to store it. We are not a HIPAA business associate and do not sign BAAs.

Reporting a vulnerability

If you believe you've found a security issue, email security@exteriorconsigliere.com with enough detail to reproduce it. We welcome good-faith reports, will acknowledge them, and won't pursue legal action against researchers who report responsibly and avoid accessing other customers' data.