Security & data protection
Where your clients’ numbers live, and who can reach them.
You are entering other people’s financial lives into our software. This page states plainly how that data is protected, which outside companies touch it, and what we have not yet earned the right to claim.
We are not SOC 2 certified. Here is what we do instead.
RetirementForge holds no SOC 2 report — not Type I, not Type II. We would rather tell you that directly than display a badge and let you assume otherwise.
What we can show you is the architecture itself, which is described below in enough detail to be checked rather than trusted. Our infrastructure providers carry SOC 2 Type II attestations for the layers they operate; the controls that govern who may read a given client record are ours, and they are enforced in the database.
If your firm requires a completed security questionnaire or a formal review before onboarding, write to us and we will work through it with you.
How the platform is built
Authorization is enforced by the database
Every table in our public schema has PostgreSQL row-level security enabled, governed by more than forty explicit access policies. When an advisor queries for a client who is not theirs, the database returns zero rows — not because the interface hid a button, but because Postgres refuses to return the record. A bug in application code cannot expose another advisor's book, because application code is not what grants access.
The session audit trail cannot be edited
Every action taken in a live client session is written to an append-only event log. That table carries insert and read policies only — there is no update policy and no delete policy anywhere in our schema. Once a session event is written, it cannot be altered or removed through the platform, by an advisor or by an administrator. That is a deliberate constraint: an audit trail you can edit is not an audit trail.
Encrypted in transit and at rest
Client financial data is stored in a managed PostgreSQL database encrypted at rest with AES-256, and reached only over TLS. Data is held in a United States region. We do not collect Social Security numbers or financial account numbers anywhere in the platform. Date of birth is optional and used only to drive age-based calculations.
Authentication and session control
Sign-in is handled by Supabase Auth using HTTP-only cookie sessions, so credentials are never held in browser-accessible storage. Accounts are single-session: signing in on a new device signs the account out everywhere else, which stops shared logins from quietly turning one seat into five.
Infrastructure built on audited providers
RetirementForge runs on Vercel and Supabase. Both maintain SOC 2 Type II attestations covering the hosting and database layers we build on. That is their audit, not ours — see below for exactly what that does and does not mean about us.
Least-privilege service access
Elevated database credentials are confined to server-side operations that require them and are never exposed to the browser. Client-side code holds only a publishable key whose reach is bounded by the same row-level policies described above.
Who else touches the data
Every outside service that processes data on our behalf, and what it receives. There are no others.
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database, authentication, realtime session sync | Account and client planning data |
| Vercel | Application hosting and delivery | Request metadata, traffic analytics |
| Stripe | Subscription billing | Billing contact and payment method — card details go directly to Stripe and never touch our servers |
| Resend | Transactional email (invitations, notifications) | Name and email address |
| Google Analytics | Marketing site analytics | Anonymous usage and traffic data |
| PostHog | Product usage analytics | Feature usage events tied to an account identifier |
Found something? Tell us.
If you believe you have found a vulnerability, email us with the details and how to reproduce it. We will confirm receipt and keep you updated through the fix. We will not pursue anyone who reports a genuine issue in good faith.
support@retirementforge.comSee also our Privacy Policy and Terms of Service.