Controls
What is in place today.
Encryption at rest and in transit
AES-256 envelope encryption with per-entry keys for the Digital Safe vault. TLS 1.3 in transit. No single key exposes all data, even in a worst-case breach.
Two-factor authentication
Optional TOTP MFA with backup codes for every account. OAuth users (Google, Microsoft) verify via email code for MFA management.
Instant session revocation
Sessions are revocable at the edge through Upstash Redis. Password changes, role changes, and admin revocation invalidate sessions instantly across all devices.
Role-based access control
Three roles (Client, Advisor, Admin) with row-level enforcement. Advisors only see households they are explicitly assigned to. Admins are fully audit-logged.
Tamper-evident audit logging
Administrative actions, document generation, client consent events, and every impersonation event land in a hash-chained audit log, so records cannot be silently altered or removed. Audit history is exportable for compliance review and evidentiary use.
Database isolation
Postgres with row-level security policies, prepared statements only, no raw SQL. Bcrypt password hashing. All credentials encrypted with AES-256-GCM.
Document generation server-side
No client data ever touches a third-party document service. Generation runs server-side in our infrastructure with full chain-of-custody logging.
Real-time error monitoring
Sentry integration in production with PII scrubbing. We see and triage every production error, usually before users report them.
Impersonation guardrails
Advisor and admin impersonation is HMAC-signed, time-limited (1-hour TTL), household-scoped, and audit-logged on both start and stop.
Document integrity locks
Every attorney-reviewed template is locked behind a SHA-256 integrity manifest verified in CI. A clause cannot change silently: template changes require a governance process and renewed attorney sign-off, with the reviewing attorney identified by name and bar number in the internal review log.
Rate limiting and account lockout
API rate limiting across authentication and sensitive endpoints. Failed login attempts trigger a timed account lockout. Both run in production, not just on paper.
Engineering verification
More than 9,400 automated tests run on every release, including contract tests on the AI guardrails and credentialed end-to-end coverage of the advisor and client surfaces. Dependency audits run in CI. The same rigor that protects the documents protects the codebase.