EST. MMXXV
Trust & Security
Atrium Wealth Council® is built by Alter3d Development LLC. This page summarizes how we protect your financial information, the vendors we rely on, and how to reach us about security.
Security posture
- TLS 1.2+ everywhere; HSTS on all production hostnames.
- Row-Level Security on every user table - server-enforced, not client-checked.
- Admin actions verified via server-side role checks (`has_role()`), never client storage.
- Secrets stored in Lovable Cloud's managed vault, never in the codebase.
- CSP, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy on all responses.
- Stripe webhooks validated by signature; JWTs verified on protected functions.
- Tamper-evident audit log of role, billing, household, and account-deletion events.
- Automated CI: lint, typecheck, unit tests, RLS tests, end-to-end auth flows, dependency scan.
Data handling
Financial data you enter is stored encrypted at rest in our managed Postgres database and is only accessible to you (and household members you've explicitly invited). Uploaded documents live in private storage buckets, scoped to your user ID.
You can export or delete your account at any time from your profile. Deletion cancels active subscriptions, removes uploaded files, and erases owned rows within minutes.
Subprocessors
We share data only with the vendors required to operate the service:
| Vendor | Purpose | Region | Policy |
|---|---|---|---|
| Supabase | Database, authentication, file storage | US | Link |
| Stripe | Payment processing & subscription billing | Global | Link |
| Plaid | Read-only bank account connections (no credentials stored by us) | US | Link |
| Cloudflare | Edge hosting, DDoS protection, TLS termination | Global | Link |
| Lovable | Application hosting platform & AI Gateway | EU/US | Link |
| Resend | Transactional email delivery | US | Link |
| OpenAI / Google (via Lovable AI) | Large language model inference for in-app agents | US | Link |
Compliance status
Atrium Wealth Council® is SOC 2-aligned, with a formal audit planned. We follow controls mapped to the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality) and run on provider infrastructure (Supabase, Stripe, Cloudflare) that is SOC 2 Type II-attested.
Controls evidence
- Access control: row-level security on every member table; admin actions require a verified admin role plus MFA (AAL2) with a one-hour session timeout.
- Encryption: TLS in transit, encryption at rest at the provider, and no service keys in any client bundle.
- Auditability: append-only audit log and security event log with admin CSV export.
- Change management: automated test suite and security regression tests run on every release.
- Data lifecycle: soft delete with a 30-day restore window, then scheduled permanent purge.
- Monitoring: rate limiting, content security policy reporting, and alerting on anomalous sign-in and delivery events.
Incident response
If we discover a breach affecting your data, we will notify affected members by email without undue delay, and in any case within 72 hours of confirmation, with the facts known at the time and the steps we are taking.
Responsible disclosure
Found a vulnerability? Please email contact@atriumwealthcouncil.com with reproduction steps. Full policy at /.well-known/security.txt.