Security & Continuity

Tenant isolation

Every organization’s data lives in the same database but is isolated by row-level access controls. A query from one organization cannot read another organization’s invoices, price lists, suppliers or claims. Within an organization, members hold one of three roles — admin, manager or viewer — and each role can only perform the actions it is granted.

Encryption and transmission

All traffic between your browser and the application is encrypted with TLS. Data at rest in the database and uploaded source documents are encrypted by the underlying cloud storage layer.

Backups and retention

The database is backed up automatically with point-in-time recovery, and backups are retained for 7 days. Uploaded source documents are stored redundantly. We test the restore path before major releases. Organization administrators can export a full copy of their data at any time from Settings → Your data, and we recommend keeping a periodic export of your own.

Account and uploaded content are retained while an organization is active and for 30 days after closure, after which they are deleted. Security logs and telemetry are retained for up to 12 months. Billing and tax records are kept for the period required by law.

Access controls and audit logging

Sign-in is handled through Supabase Auth with Google OAuth or magic-link email. Sessions time out after a period of inactivity. Sensitive actions — inviting users, changing plans, deleting data, approving consultant access — are recorded in the organization’s audit log.

Incident communication

If we become aware of a service-wide issue, we post a notice at the top of the application and update it until the incident is closed. During an incident we reply to support email with the current status rather than asking for a diagnosis. You can also check the status of any ongoing incident on our support page.

Vulnerability reporting

If you discover a security issue, please email us at security@guardianprice.app. We will acknowledge receipt within two business days and work with you to resolve it responsibly.

Contact

Vernco LLC — security@guardianprice.app