What we can show you, and what we cannot yet.

Access rules are row level security policies in PostgreSQL. The database evaluates them on every query. An interface bug cannot widen those rules because the interface is not what grants access.

Automated checks replay the separation rules and report any drift. The same checks run after every change to the application.

An access attempt is recorded first, then the decision is recorded. That is why a refused attempt exists in the record. These records cannot be edited or deleted by anyone, including us, because the tables accept inserts only.

This also means a mistake cannot be erased. It can only be corrected by a new entry. That is a deliberate trade: the correction and the record it corrects both remain visible.

The applications are hosted on Supabase and use PostgreSQL. Counterline and Sidefile are in separate projects that share nothing. Data for United States customers sits at rest in the United States.

Files sit in a separate object store. They are reachable only through a function that checks the caller's permission before handing over anything. We hold no copy outside that store. The applications have no data warehouse, no analytics pipeline and no third party tracking.

There is no SOC 2 attestation, and none is in progress. There is no ISO certification. No penetration test report is available yet. There is no single sign on yet, and there is no published uptime history.

A business associate agreement is available where required. A data processing addendum is available. Anything on this list will move to the section above on the day it becomes true, with the date.

You can take a full export at any time, in an open format, without conditions, without an exit fee and without asking why.

The export includes the ledger and the register, because a record you cannot take with you is not a record you own.