Encrypted in Transit
All data between your browser and our servers is encrypted via TLS 1.2 or higher. We enforce HTTPS on every endpoint.
Isolated Storage
Each user's data is logically isolated using row-level security. No user can access another user's records.
SOC 2 Infrastructure
Our cloud infrastructure runs on Supabase and Vercel, both of which maintain SOC 2 Type II certifications.
Built on SOC 2 Type 2
Certified Infrastructure
BookBalance.io stores and processes all data on Supabase, a cloud infrastructure provider that holds SOC 2 Type 2 certification -- the highest level of independent security audit for cloud platforms, conducted by a third-party auditor every year.
What this means for your organization
SOC 2 Type 2 is not a one-time snapshot. An independent auditor reviews Supabase's controls over time and confirms they meet the Trust Services Criteria -- covering security, availability, processing integrity, confidentiality, and privacy. The audit repeats annually.
This means the infrastructure your nonprofit's financial data sits on is independently verified, not just self-certified.
View Supabase security documentation →Important distinction: Supabase's SOC 2 certification covers the infrastructure layer -- the servers, storage, and network. BookBalance.io has not independently completed its own SOC 2 audit. We are transparent about this. If your board or auditor requires a SOC 2 report, contact us and we will provide Supabase's compliance documentation and a written summary of our own controls.
Infrastructure & Hosting
BookBalance.io and the Book990 application are hosted on Vercel's global edge network. All application data is stored in Supabase, a managed Postgres database platform hosted on AWS in the US East (Northern Virginia) region.
Both Vercel and Supabase maintain SOC 2 Type II compliance, ISO certifications, and enterprise-grade physical security at their data centers. We do not operate our own servers or data centers.
Encryption
All data transmitted between your browser and our services is encrypted using TLS 1.2 or higher. We do not support older, insecure protocols such as SSLv3 or TLS 1.0.
Data stored in our database is encrypted at rest by Supabase using AES-256. Database backups are also encrypted at rest and retained for point-in-time recovery.
Passwords are never stored in plain text. User authentication is handled entirely by Supabase Auth, which uses bcrypt hashing. We never have access to your raw password at any point.
Access Controls
Access to your data is enforced at the database level using Postgres Row Level Security (RLS). Every query against the database includes a user-scoped policy that prevents any user from reading or writing records that do not belong to them.
Shared Responsibility
Security is a joint effort. Here is a clear breakdown of what BookBalance.io handles and what remains in your organization's control.
| Area | BookBalance.io | Your Organization |
|---|---|---|
| Infrastructure security | ✓ SOC 2 Type 2 certified via Supabase | No action required |
| Data encryption (transit + rest) | ✓ Handled automatically | No action required |
| Row-level data isolation | ✓ Enforced at database level | No action required |
| Account credentials | Secure storage, never plain text | ✓ Use a strong unique password |
| User access management | Role-based permissions enforced | ✓ Remove access when staff leave |
| Data accuracy | Validation rules and compliance checks | ✓ Review and approve entries |
| Device security | Sessions expire on inactivity | ✓ Lock devices, use trusted networks |
Your Data
We collect only the information necessary to provide our services. We do not sell, rent, or share your data with third parties for advertising or marketing purposes. See our Privacy Policy for a full description of what we collect and why.
Book990 App Security
Book990 is a web application for preparing Form 990 data. It is deployed at app.bookbalance.io as a separate, isolated application from the marketing site.
Incident Response
In the event of a security incident that affects your data, we will notify affected users by email within 72 hours of becoming aware of the incident. Our notification will describe what happened, what data was affected, what we have done to address it, and what steps you can take to protect yourself.
If you discover a security vulnerability in our products, we ask that you report it to us privately before disclosing it publicly. We are committed to investigating all reports promptly.
To report a security vulnerability, email support@bookbalance.io. Please include a description of the issue, steps to reproduce it, and your contact information. We will acknowledge receipt within 48 hours.
Security questions answered.
Questions & Contact
If you have questions about our security practices that are not answered here, please reach out. We are a small team and we take these matters seriously.