Security

How your data is protected

1. Encryption at rest

Sensitive fields, such as bank account numbers and the tokens used to connect other software, are encrypted with AES-256-GCM at the application layer before they reach the database, using a versioned key ring that supports key rotation. The encryption key is held in environment configuration and never written to the database, so a database export alone does not reveal those fields. Our database provider also encrypts stored data at the disk level.

2. Encryption in transit

Every page and API request is served over HTTPS with HTTP Strict Transport Security (HSTS, with preload). We do not accept plaintext HTTP connections.

3. Tenant isolation

Every CPA firm and every applicant is scoped by database-level row-level security. For requests made with a user's own session, the database itself (not just application code) enforces that one firm cannot read another firm's clients, and one applicant cannot read another's files. A small number of server-side routines use elevated database access. Each applies explicit ownership checks before it runs, and our automated checks flag new uses that lack a guard.

4. Audit trail

Changes to your data, such as uploads, deletions, status transitions and role grants, are recorded in an append-only audit log. Database triggers reject any update or delete of a log entry. The log records who acted, when, and what changed, so we can answer “was this record modified, and by whom?” for the changes it covers.

5. Authentication

Sign-in uses Supabase Auth, with an email address and password or an emailed one-time code or link. We do not currently offer two-factor authentication. We will update this page if that changes.

6. Authorization

Authorization checks (what each authenticated user is allowed to do) are enforced at the database, the API, and the UI. Browser-mutable user metadata is never trusted for authorization decisions.

7. Where your data sits

Application data and uploaded documents are stored in Supabase, on AWS in the United States (us-west-1, Northern California). Our application servers run on Vercel in the United States, and other vendors, such as email, payment and AI providers, are also based in the United States. Your data is stored and processed outside Canada. See Sub-processors for the vendors that touch personal information, what data each one sees, and the region each one operates in.

8. Retention

We retain your application data while your account is active. Our Privacy Policy sets out how long we keep personal information after an account is closed, and you can ask for access to or deletion of your personal information with the data request form. Audit logs are retained for the life of the platform; they record who acted, not the document contents themselves.

9. Backups

Our database provider is responsible for database backups. We have not yet completed a documented test of restoring from them. A backup that has never been restored is unproven, and we will update this section once we have run and recorded a restore test.

10. Vendor due diligence

We rely on a small set of established vendors (listed at /sub-processors) for hosting, database, email, and AI features. We do not handle credit card numbers ourselves. Payment processing, when applicable, goes through Stripe.

Bookkeeping software

Live connections to QuickBooks Online and Xero are not available yet; they are on our roadmap. Today you bring bookkeeping data in by uploading files, such as a General Ledger export or a Trial Balance. When we add live connections, this page will describe how connection tokens are stored, how you disconnect, and how tokens are revoked.

What we have not yet done

Buyers reasonably ask about independent testing, certifications and sign-in security. Here is where we stand today.

• Independent penetration test: not yet performed. We will share a summary with customers on request once one is complete.
• SOC 2 and ISO 27001: we do not currently hold either certification.
• Two-factor authentication: not currently offered.
• Backup restore test: not yet completed.

Reporting a security issue

If you believe you have found a security vulnerability in any Capital Toolkit property (the marketing site, the apply funnel, the platform, the API, or our integrations) please email security@capitaltoolkit.com.

What to include: a description of the issue, the URL or endpoint affected, steps to reproduce, and (if known) the category of impact (data disclosure, privilege escalation, denial of service, etc.). Screenshots and short proof-of-concept scripts are welcome.

What we will do:

• Acknowledge receipt within five business days.
• Triage the report and respond with our assessment and an expected remediation window.
• Keep you informed as the fix is built, deployed, and verified.
• Credit you publicly (or anonymously, your preference) once a fix has shipped, if you would like.

Coordinated disclosure: what we promise

Capital Toolkit does not currently run a paid bug bounty program, but we welcome good-faith security research. We commit to the following:

• We will not pursue legal action against researchers who act in good faith, do not exfiltrate or destroy data, do not degrade service for other users, and give us a reasonable opportunity to fix issues before disclosing them publicly.
• We will not contact your employer, your school, or law enforcement on the basis of a good-faith report.
• If you accidentally access data that does not belong to you, please stop, do not download or further access it, and tell us what happened. We will treat that as part of the report, not as misconduct.

Out of scope

• Denial-of-service attacks, traffic flooding, or anything that degrades availability for legitimate users.
• Social engineering of our employees, contractors, or customers.
• Physical attacks against our offices or those of our vendors.
• Vulnerabilities in third-party services we depend on. Please report those to the vendor directly. We are happy to help you reach the right team.
• Reports generated solely by automated scanners with no demonstrated impact.

Machine-readable disclosure policy

Our /.well-known/security.txt file follows RFC 9116 (opens in a new tab). Both the marketing site (capitaltoolkit.com) and the platform (app.capitaltoolkit.com) publish a security.txt that points back to this page.

More information

For privacy-related requests (access, correction, deletion of your personal information), see the Privacy Policy or use the data request form. For general questions, write to contact@capitaltoolkit.com. For security-specific reports, use security@capitaltoolkit.com.