Back to Home

Security Policy

Last Updated: 10/2026

Security isn't just a feature at W9Vault — it's our foundation. We understand that accounting professionals handle some of the most sensitive financial information, so documents are encrypted in the browser before they ever leave it. This page describes what we do today.

Our Security Architecture

Client-Side Encryption

  • All documents are encrypted in the vendor's browser before upload using TweetNaCl XSalsa20-Poly1305 encryption
  • Each file gets its own unique encryption key generated with cryptographically secure random number generators
  • Our servers never receive the unencrypted file. Each file's key is protected by a separate key held on our servers, and only the requester can download the file
  • The file's encryption key is unwrapped only as part of the authorized upload and download flow

Transport & Storage Security

  • HTTPS (TLS) encryption for all data in transit
  • Database storage encrypted at rest by our database provider, Supabase
  • The key that protects file keys is stored as an encrypted server-side secret and is never sent to browsers

Automatic Data Deletion

  • All uploaded documents automatically deleted after 30 days (no exceptions)
  • Secure deletion using cryptographic erasure
  • No long-term document storage (by design)
  • Audit logs confirm successful deletion

Application Security

Access Controls

  • Passwords must be at least 8 characters
  • Sign-in and sessions are handled by Supabase Auth
  • Database row-level security: each account can see only its own requests and files

Attack Prevention

  • Content Security Policy (CSP) prevents XSS attacks
  • Input validation and sanitization on all user inputs
  • Rate limiting on forms, uploads and API routes to prevent abuse
  • Secure error handling prevents information leakage

Monitoring & Detection

  • Error and security-event reporting through Sentry, with personal data removed
  • Audit logging of uploads, downloads and automatic deletions

Infrastructure Security

Hosting & Network

  • Hosted on Vercel
  • Global CDN with DDoS protection provided by Vercel
  • Dependencies checked for known vulnerabilities on every change

Database Security

  • PostgreSQL hosted by Supabase, with row-level security on every table holding customer data
  • Database credentials stay on our servers and are never sent to browsers

Vendor Security

The providers we rely on:

  • Supabase: SOC 2 Type II certified
  • Stripe: PCI DSS Level 1 certified for payment processing
  • Vercel: SOC 2 Type II certified hosting platform
  • Resend: email delivery over TLS

Compliance & Auditing

Standards & Certifications

  • W9Vault itself does not hold a SOC 2 certification; our hosting and database providers do (see above)
  • How we handle personal data under the GDPR is described on our GDPR page
  • CCPA compliance for California users

Security Reviews

  • Internal security reviews of the application and database
  • Automated secret scanning and dependency audits on every change
  • Every build is checked for leaked secrets before it can deploy

Incident Response

Detection & Response

  • Automated error and security-event reporting
  • Incident response procedures activated within 4 hours
  • Clear escalation procedures for security incidents
  • Transparent communication plan for affected users

Breach Notification

  • Immediate investigation of potential breaches
  • Notification within 72 hours if required by law
  • Clear communication about impact and remediation steps
  • Post-incident security improvements implemented

Data Protection by Design

Privacy-First Architecture

  • Client-side encryption by default
  • Minimal data collection principles
  • Automatic data deletion timelines
  • Error reports are scrubbed of personal data before they are sent to Sentry

Secure Development Practices

  • Every change is tested against a separate staging environment with synthetic data before release
  • Automated security checks on every change

Security Transparency

Reporting Security Issues

We take security seriously and appreciate responsible disclosure:

  • Email: security@w9vault.com
  • Include detailed description of the vulnerability
  • Provide steps to reproduce if possible
  • Allow reasonable time for response and remediation

Our Response Commitment

  • Acknowledgment within 24 hours
  • Initial assessment within 72 hours
  • Regular updates throughout investigation
  • Recognition for responsible security researchers

Physical Security

Data Center Security

  • Data is stored with Supabase and served by Vercel, both SOC 2 Type II certified
  • Physical data-centre security is provided by their cloud infrastructure (AWS)

Questions & Contact

For security-related questions or to report security issues:

We maintain this security policy with regular reviews and updates to reflect our ongoing commitment to protecting your sensitive financial data.