Every change, export, and admin action is written to an append only log you can export any time. Firms are isolated at the data layer, so your clients’ numbers never sit next to another firm’s.
The same plan can carry a family’s numbers for decades. These are the measures that keep that data private, isolated, and recoverable.
Traffic runs over HTTPS with TLS 1.2 or higher, and HSTS is preloaded across every subdomain. Data sits encrypted at rest with AES-256 in Neon managed Postgres. Hardened response headers — deny framing, block MIME sniffing, cross origin isolation — ship on every request.
Identity, sessions, and multifactor are managed by Clerk, and MFA is required for firm administrators. Access is role based and enforced on the server for every action, never just hidden in the interface.
Every client data query is scoped by firm ID at the data layer. Automated isolation tests run across all API routes on every build, and responses are never edge cached — so one firm's numbers can't surface in another firm's session.
Clients link accounts from their own portal, authenticating with their bank through Plaid — Foundry never sees or stores bank credentials, only an encrypted access token. Access is read only: balances, holdings, transactions, liabilities. Foundry requests no payment or transfer permission and cannot move money in, out, or between accounts. Clients can unlink an institution at any time.
Dependencies are scanned on every build, security relevant changes are reviewed before they merge, and disclosed vulnerabilities are triaged on a fixed clock. Sentry watches errors and performance in production with client PII redacted.
Application data lives in US regions on Neon managed Postgres with point in time recovery. Incidents follow a documented runbook with on call response. Nothing about recovery depends on a single machine staying up.
We name every third party that processes customer data, and we obtain and review each vendor’s current SOC 2 / ISO attestation.
| Vendor | What it handles | Certifications |
|---|---|---|
| Stripe | Payments & billing | PCI DSS Level 1 · SOC 2 Type II · ISO 27001 |
| Clerk | Authentication & MFA | SOC 2 Type II |
| Plaid | Bank & brokerage account linking | SOC 2 Type II · ISO 27001 · ISO 27701 |
| Neon | Managed Postgres — your data | SOC 2 Type II · ISO 27001 · HIPAA eligible |
| Vercel | Hosting & edge runtime | SOC 2 Type II · ISO 27001 |
| Sentry | Error & performance monitoring | SOC 2 Type II · ISO 27001 · HIPAA eligible |
| Upstash | Rate limiting cache | SOC 2 Type II |
| Resend | Transactional email delivery | SOC 2 Type II |
| Azure OpenAI | Document extraction (AI Import) | SOC 1/2/3 · ISO 27001/27017/27018/27701 |
No model training.Documents uploaded for AI Import are never used to train models.
30 days’ notice. Written notice to your owner of record before we add or replace any subprocessor that handles client data. You may object on reasonable grounds during that window.
US data residency. Application data is stored in US regions.
Full subprocessor list and our Data Processing Addendum live in the DPA.Last reviewed: 2026-07-18
Found a security issue? Tell us and we’ll get on it. We respond to every good faith report and won’t pursue researchers who act in good faith.
A live Zoom session where we build a working plan together. Bring a brokerage statement, a tax return, or a list of constraints — redact the names if you like; the plan builds the same. The data goes in fast and we plan in front of you.
