Security
How We Protect Your Data
The facts a CFO asks for before connecting their books. If something you need isn't here, ask us.
Where Your Data Lives
Your company's data sits in a Supabase Postgres database on AWS in the United States (us-east-1). The app runs on Vercel.
Each Company Walled Off
Postgres row-level security checks every read and write against your company, so one company can't reach another's rows. Inside your company, each person's role (Owner, Admin, Editor, Department Head, Viewer, Commenter or Investor) limits what they see.
Encryption
Every connection uses TLS. Supabase encrypts the database and file storage at rest. Tokens for your connected systems sit encrypted in Supabase Vault, and only our server can read them.
Two-Step Sign-In
Any user can turn on two-step sign-in with an authenticator app (a 6-digit TOTP code) in Settings. BurnRateIQ staff with admin access must use it. Passwords need at least 10 characters with a lowercase letter, an uppercase letter, a number and a symbol.
Read-Only Connections
We ask for read-only access wherever a system offers it: Xero, Stripe, Deel, Remote, FreshBooks, Wave and Zoho Books. QuickBooks and NetSuite have no read-only option, so we request their standard access and only read. We never write to your books, and you can disconnect any system from Data Sources.
AI Processing
Anthropic's Claude reads the files and models you upload, matches your accounts to model lines, answers Ask BRIQ questions from your model's figures, drafts investor updates and suggests plan changes from public news it searches on the web (those searches carry no customer data). Each task sends only the data it needs, under terms that bar Anthropic from training on it. AI never sets a number in your model without a validation step or your approval. The Privacy Policy lists what each feature sends.
Audit Log
We record sign-ins and failed sign-ins, password and two-step sign-in changes, Excel and board deck exports, and budget locks, with who did it and when.
Backups
Every night we copy the full database and all uploaded files, encrypt them, and store them outside our hosting provider for 14 days. The key that unlocks them is kept offline. Your Excel export is also a full copy of your model that you keep.
Retention and Deletion
Close your account and we delete your company data within 30 days, except records the law or billing requires us to keep.
Compliance
We don't hold a SOC 2 report today. We'll start the audit when customers need it. Until then, we answer security questionnaires on request.
Who Processes Your Data
- Supabase
- Database, sign-in and file storage
- Vercel
- Application hosting
- Anthropic
- AI features: reading files, Ask BRIQ, investor updates and plan suggestions
- Stripe
- Payments for our plans and partner payouts
- Resend
- Email delivery
- Cloudflare
- Bot check on public forms and encrypted nightly backups
- GitHub
- Source code, automated tests and quality checks
- Google and LinkedIn
- Sign-in, if you choose it
- Slack
- Internal alerts to our team
The full subprocessor list: the data each one handles and where
About BurnRateIQ
BurnRateIQ is built and run by Yoni Rubin, founder.
Report a Vulnerability
Found a security problem? Tell us below, with the steps to reproduce it. Please give us time to fix it before you tell anyone else.