Changes to client records, PDF exports, and admin actions are written to an append only audit log, and each client’s history is visible in the app. Every client query is scoped to your firm on the server, so another firm sees your clients’ numbers only if you share them.
The same plan can carry a family’s numbers for decades. These are the measures that keep that data private, isolated, and recoverable.
Traffic runs over HTTPS with TLS 1.2 or higher, older versions are refused, and HSTS keeps browsers on HTTPS. Data sits encrypted at rest with AES-256 in Neon managed Postgres, and uploaded documents are encrypted with AES-256 in Vercel Blob. Every app response carries hardened headers that deny framing, block MIME sniffing, and isolate the app's window from other sites.
Identity, sessions, and multifactor authentication are managed by Clerk, and every user can turn on an authenticator app or a text message code as a second factor. Access is role based and enforced on the server for every action, never just hidden in the interface.
Every client data query is scoped by firm ID on the server, using the firm from your session rather than anything the browser sends. An automated isolation test scans the client, CMA, CRM, and portal API routes for that scoping, and API responses are never cached, so another firm sees your clients' numbers only if you share them.
Clients link accounts from their own portal, authenticating with their bank through Plaid. Foundry never sees or stores bank credentials, only an encrypted access token. Access is read only: balances, holdings, transactions, liabilities. Foundry requests no payment or transfer permission and cannot move money in, out, or between accounts. Clients can unlink an institution from their portal.
Every change to the main branch, plus a weekly run, is scanned for vulnerable dependencies, leaked secrets, and code flaws, and disclosed vulnerabilities are triaged on a fixed clock. Sentry watches errors and performance in production. We identify users to Sentry by ID only, never name or email, and session replays mask all text and block images.
Application data lives in US regions on Neon managed Postgres, which keeps seven days of history for point in time recovery. Uploaded documents are stored in Vercel's US East region. Nothing about recovery depends on a single machine staying up.
We name every third party that processes customer data, and the attestations each one publishes.
| Vendor | What it handles | Certifications |
|---|---|---|
| Stripe | Payments & billing | PCI DSS Level 1 · SOC 1/2/3 |
| Clerk | Authentication & MFA | SOC 2 Type II |
| Plaid | Bank & brokerage account linking | SOC 2 Type II · ISO 27001 · ISO 27701 |
| Neon | Managed Postgres · your data | SOC 2 Type II · ISO 27001 · HIPAA eligible |
| Vercel | Hosting & document storage | SOC 2 Type II · ISO 27001 |
| Sentry | Error & performance monitoring | SOC 2 Type II · ISO 27001 · HIPAA eligible |
| Upstash | Rate limiting cache | SOC 2 Type II |
| Resend | Transactional email delivery | SOC 2 Type II |
| Azure OpenAI | AI Import extraction & the Forge agent | SOC 1/2/3 · ISO 27001/27017/27018/27701 |
No model training.Documents uploaded for AI Import are never used to train models.
30 days’ notice. Written notice to your owner of record before we add or replace any subprocessor that handles client data. You may object on reasonable grounds during that window.
US data residency. Application data is stored in US regions.
This is the subprocessor list our Data Processing Addendum refers to.Last reviewed: 2026-10-06
Found a security issue? Tell us and we’ll get on it. We respond to every good faith report and won’t pursue researchers who act in good faith.
A live Zoom session where we build a working plan together. Bring a brokerage statement, a tax return, or a list of constraints. Redact the names if you like; the plan builds the same. The data goes in fast and we plan in front of you.
