Bridge security stack:
- TLS 1.3 for everything in transit — same standard as your bank
- AES-256 at rest — every database row, every file, every backup
- Supabase Row-Level Security — the database itself enforces "users can only see their own data"
- Plaid handles bank credentials — we never see them
- SOC 2 Type II certification: in progress, targeted for late 2026
- Vendor list (Plaid, Supabase, Resend, Vercel, Anthropic) all SOC 2 Type II
Plain-English version
We treat your business bank data the way you'd treat a tax return — encrypted, locked down, only seen when you explicitly view it.