Security
Effective date: May 2026
Infrastructure
Tradeworth runs on modern managed infrastructure, including Vercel and Supabase. We choose providers with strong security programs, including SOC 2 compliant services.
Encryption
Data is encrypted in transit using TLS 1.3 and encrypted at rest through our database and storage providers.
Authentication and identity
Authentication is handled by Supabase Auth. Password-based accounts use secure hashing with bcrypt. Session and token controls are enforced server-side.
Access controls and tenant isolation
Every core data table uses row-level security policies with organization-scoped access controls. Data access is isolated per workspace to enforce strict multi-tenant boundaries.
Payments
Stripe processes all payment information. Tradeworth does not store card numbers or raw card details on our servers.
Vulnerability disclosure
If you discover a security issue, email security@penworth.app. We respond to initial reports within 72 hours.