Security

The platform is in invite-only beta. Self-serve signup is disabled at the server (not just hidden in the UI), every application route requires an authenticated session enforced by middleware, and authentication endpoints are rate-limited per IP to dampen credential stuffing.

Every table that holds customer deal data is isolated with Postgres row-level security (RLS). Those policies fire on every read and write made with a customer session, so isolation does not depend on application code remembering to add a WHERE clause. Tables that hold only public reference data — federal and agency datasets that are the same for every customer — do not carry tenant policies, because they contain no tenant rows.

We treat RLS as the primary control, not the only one. Two features deliberately read with elevated privileges and are scoped in application code instead: anonymous share links, which resolve a single document from its own token, and the public scorecard, which serves a fixed, anonymized column set. Bugs in that application layer are possible — we have found and fixed one — so we also run tenant-isolation checks against the live database and treat any cross-tenant read as a stop-everything defect.

We build on managed, audited providers rather than running our own servers. Our subprocessors are: Supabase (Postgres hosting, authentication, row-level security), Vercel (application hosting and edge network, TLS everywhere), Stripe (payments — card data never touches our systems), Sentry (error monitoring, with request payloads redacted on billing and webhook routes and on the document-intake, AI-copilot, and reference-search routes that carry deal content — the redaction list is unit-tested in source), Resend (transactional email), Anthropic (the AI copilot and document-intake assistance), Cohere (embeddings for reference-library search), and the US Census Bureau geocoder (converting a property address to a census tract).

Anthropic and Cohere are the subprocessors that see deal content as part of a feature rather than as infrastructure, and only for the features named above. Deterministic underwriting math never touches either of them. We will give notice on this page before adding a subprocessor that processes customer content.

Saved underwriting runs execute on our own server infrastructure, not in your browser. That is deliberate: a run that is persisted, version stamped and auditable has to be computed somewhere we control, so the engine version recorded on the run is the version that actually produced the numbers. Your scenario inputs are never sent to any third-party model or analytics service as part of that calculation — the deterministic calc engine is our own code, running in our own environment.

The public tools on this site are the exception in the other direction: the interactive screener on our demo page runs entirely in your browser and sends nothing to a server at all.

Security includes being honest about data quality. Every number the platform produces carries one of five provenance grades — verified, industry proxy, modeled, conflicted, or no data — and an immutable audit log records every deal change and simulator run. You can always trace what a figure is based on and who changed what, when.

Your deal data is yours. We do not use customer data to train AI models, and we do not sell or share it. Where deal content is sent to Anthropic to power the copilot or document intake, it is sent under Anthropic's Commercial Terms of Service, section B of which provides that Anthropic may not train models on customer content submitted through its API. Reference research content is built from public primary sources (HUD MAP Guide, IRC, agency selling guides), never from customer deals.

Found something? We want to know. Email justin@credealvision.com with details and we'll respond promptly. Please give us a reasonable window to remediate before public disclosure.