Security

In plain English: your data is encrypted end-to-end, stored on enterprise-grade infrastructure, and never accessible to anyone who doesn't need it. involy is built by ThinkOpen Inc. — a cybersecurity firm — so security is baked in, not bolted on.

How we protect your data

Every piece of data you store in involy is protected by two layers of encryption:

• At rest — 256-bit AES encryption. All data stored in our database is encrypted at the storage layer. This means that even in the unlikely event of physical media theft or unauthorized database access, your data cannot be read without the encryption keys, which are managed separately.
• In transit — TLS 1.3.All connections between your browser and involy's servers use TLS 1.3, the current industry standard. Older, weaker TLS versions (1.0, 1.1) are disabled. HTTP connections are redirected to HTTPS automatically.

Sensitive credentials and secrets (API keys, signing keys, database passwords) are stored as environment-level secrets in our deployment platform and are never committed to source code or log files.

Infrastructure

involy is built on a modern, defense-in-depth cloud stack designed for reliability and isolation:

Our database enforces a deny-all defaultvia Row-Level Security: no table is accessible until an explicit allow policy is configured for the authenticated application role. This means that even a misconfigured query cannot accidentally expose another tenant's records.

Payments & PCI compliance

involy uses Stripe for all online payment processing. Stripe is a PCI-DSS Level 1 certified payment processor — the highest level of payment card security certification available.

When a client pays an invoice, their card or bank details are entered directly into Stripe's hosted payment page. This data flows directly from your client's browser to Stripe's systems and never passes through involy's servers. We do not store, log, or transmit full card numbers, CVV codes, or bank account numbers. The most we store is the last-four digits of a card for display purposes.

Because sensitive payment data stays entirely within Stripe's certified perimeter, involy operates at a minimal PCI scope.

Access controls & least privilege

Access to involy's production systems follows a strict least-privilege model:

• Application database role. The application connects to the database as a scoped role (coffee_app) that has only the specific read/write permissions required by the application code — no superuser access, no DDL permissions at runtime.
• Engineer access. Direct production database access is restricted to senior ThinkOpen engineers, requires multi-factor authentication, and all access is logged.
• Zero standing access. Production credentials are not stored on developer machines. Access is obtained through time-limited tokens when operationally required.
• Deployment authorization. Production deployments require a verified git commit from an authorized identity and pass an automated type-check gate before reaching production.

The AI accountant

involy's AI features are powered by Anthropic Claude. When you use the AI accountant or the Ask involy assistant, structured summaries of your financial data are sent to Anthropic's API to generate your response.

Key security properties of this integration:

• Not used for training. Per our configuration, Anthropic does not use involy customer data to train its models.
• Structured tool calls only.We use Anthropic's structured tool-calling interface rather than free-form prompt construction. This is a primary defense against prompt injection attacks — user-controlled strings are never inserted directly into AI prompts.
• Minimal data surface. The AI receives aggregated financial summaries (totals, categories, date ranges) — not raw underlying records or personally identifying client information beyond what is necessary to answer your question.
• Encrypted in transit. All API calls to Anthropic use TLS 1.3.

Monitoring & reliability

involy's production environment is actively monitored for errors, anomalies, and performance degradation. We maintain:

• Application error tracking to detect and alert on exceptions and unexpected behavior in real time.
• Uptime monitoring with automated alerts when endpoints become unavailable.
• Scheduled integrity checks on critical data structures (such as the append-only financial ledger).
• Automated database backups managed by Supabase with point-in-time recovery.

Vercel's global edge infrastructure provides inherent DDoS resilience by distributing traffic across many points of presence.

Compliance & security posture

involy is built and operated by ThinkOpen Inc., a cybersecurity and managed IT firm. Security is not an afterthought — every architectural decision is evaluated through an offense-informed lens: we ask how an attacker would approach the system before we finalize a control.

Our current posture:

• SOC 2 — in progress. We are working toward SOC 2 Type II attestation. We are not yet certified; we will update this page when that changes.
• NIST CSF 2.0 alignment. Our internal security practices are designed to align with the NIST Cybersecurity Framework across the Govern, Identify, Protect, Detect, Respond, and Recover functions.
• CIS Controls v8. We use CIS Controls as a prioritization framework for defensive controls, focusing on Implementation Group 2 and above for our own infrastructure.

Your role in security

Strong security is a shared responsibility. Here is what you can do to protect your involy account:

• Use a strong, unique password. Do not reuse your involy password on other sites. Use a password manager.
• Enable two-factor authentication. If 2FA is available on your account, turn it on. It is the single most effective control against account takeover.
• Keep your email account secure. Your email is the recovery path for your involy account. If your email is compromised, your involy account is at risk.
• Watch for phishing. involy will never ask for your password by email. Be suspicious of unexpected login prompts or requests for credentials.
• Report anomalies. If you notice anything unusual in your account — unexpected logins, missing invoices, or unfamiliar activity — contact us immediately.

Responsible disclosure

We welcome security researchers and users who discover potential vulnerabilities. If you believe you have found a security issue in involy, please disclose it responsibly:

• Email security@involy.app with a description of the issue, steps to reproduce, and your contact information.
• Please do not exploit the vulnerability or access, modify, or delete data you are not authorized to access.
• Please do not publicly disclose the vulnerability before we have had a reasonable opportunity (typically 90 days) to investigate and remediate.

We will acknowledge your report within two business days, keep you informed of our investigation, and credit you in any public disclosure (unless you prefer to remain anonymous). We do not currently offer a paid bug bounty program, but we are grateful for responsible reports and will recognize meaningful findings.

Contact us

Questions about this document or your data? We read every message.

involy / ThinkOpen Inc.
5420 McConnell Ave, Los Angeles, CA 90066
Privacy: privacy@involy.app
Legal: legal@involy.app
Security: security@involy.app

This document is provided for transparency and is not legal advice. involy is in early access; we will post material changes here and, where required, notify you directly.