Security

In plain English: your data is encrypted in transit and at rest, kept separate from every other business on involy, and protected by two-factor sign-in that every account is required to use. involy is built by ThinkOpen Inc. — a cybersecurity firm — and this page describes what is in place today, not what is planned.

How we protect your data

• At rest — 256-bit AES encryption. Our database provider, Supabase, encrypts all database storage and backups with AES-256. Encryption keys are managed by the provider, separately from the data.
• In transit — TLS 1.2 or higher. Every connection between your browser and involy is encrypted with TLS 1.2 or newer (modern browsers negotiate TLS 1.3). Plain HTTP requests are redirected to HTTPS.

Application secrets (API keys, signing keys, database passwords) are stored as encrypted environment secrets in our hosting platform and are never committed to source control.

Keeping your business separate

Every business on involy is its own organization. Here is how one organization's data is kept away from another's:

• Enforced in the application. Every signed-in request is resolved to your organization on the server, and data access is filtered to that organization. The organization is never taken from anything your browser or the AI assistant can supply.
• Public links use unguessable tokens. An invoice or proposal page you share with a client is reached only by a random 192-bit token unique to that document. Re-sending an invoice issues a new token and retires the old link.
• Locked down at the database. Row-Level Security is enabled on every involy table. Any database role without an explicit policy is denied by default, the public API roles have no access to any involy table, and the application's own role cannot bypass Row-Level Security, change the schema, or own tables.

What is not in place yet: the database does not yet enforce per-organization row filtering on its own; that separation is enforced by the application layer described above. Organization-scoped database policies are on our roadmap as a second, independent layer. We will update this page when they ship.

Sign-in & sessions

• Two-factor authentication is mandatory. Every account sets up an authenticator app before it can open any data, and two-factor can't be turned off. You sign in with a passkey (which requires your device's biometric or PIN) or with your password plus a six-digit code from the authenticator. A password alone never signs you in. Moving to a new phone replaces the authenticator; the old one keeps working until the new one is confirmed.
• Recovery codes. One-time recovery codes let you back into your account if you lose your authenticator.
• Brute-force protection. Sign-in, two-factor, recovery and password-reset attempts are rate-limited.
• Revocable sessions. Changing your password or resetting two-factor signs out every existing session. Web sessions expire after seven days.

Infrastructure

Payments & PCI compliance

Online invoice payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor.

When a client pays an invoice online, their card or bank details are entered directly into Stripe's hosted payment page and never pass through involy's servers. We do not store, log, or transmit full card numbers, CVV codes, or bank account numbers. The most we store is the last four digits of a card, for display.

Because payment data stays within Stripe's certified perimeter, involy operates at a minimal PCI scope.

Access controls & least privilege

• Application database role. The application connects to the database as a scoped role that holds only the read/write permissions the application code uses — no superuser rights, no schema changes, and no ability to bypass Row-Level Security.
• Administrative access. Direct production database administration is limited to named ThinkOpen engineers.
• Tamper-evident records. The financial ledger and the audit log are append-only, enforced by database triggers. Every ledger entry is hash-chained to the one before it, so an altered or deleted entry is detectable.
• Deployment authorization. Production deployments are accepted only from authorized ThinkOpen identities.

The AI accountant

involy's AI features are powered by Anthropic Claude. When you use them, the data needed to do the job is sent to Anthropic's API:

• Ask involy and the weekly AI accountant read the records needed to answer — for example invoice and expense rows, including client and vendor names, amounts, and dates.
• Receipt and document auto-fill sends the file you upload to the model to extract its fields.

Key security properties of this integration:

• Not used for training. Under Anthropic's commercial API terms, data sent through the API is not used to train its models.
• Read-only, organization-scoped tools. The assistant can only look up your data through a fixed set of read-only tools. It cannot create, change, or delete records, and it cannot choose which organization it reads — that always comes from your signed-in session.
• Your content is treated as data. Questions you type, receipts, and vendor text are passed to the model separately from our instructions and are handled as data to analyze, which is our main defense against prompt injection.
• Encrypted in transit. All API calls to Anthropic use TLS.

Logging & recovery

• Audit log. Financial and account actions (invoices, payments, expenses, proposals, settings changes, password resets) are written to an append-only audit log.
• Request logs. Our hosting platform keeps request and function logs, which we use to investigate errors and incidents.
• Ledger integrity check. A built-in verifier recomputes the ledger's hash chain to confirm no entry has been altered.
• Backups. Daily automated database backups are managed by Supabase.

Compliance & security posture

involy is built and operated by ThinkOpen Inc., a cybersecurity and managed IT firm. We evaluate controls through an offense-informed lens: how would an attacker approach this, and what stops them?

• No third-party certification yet. involy is not SOC 2 certified and does not hold any other third-party security attestation today. We will update this page if that changes.
• Reference frameworks. We use NIST CSF 2.0 and CIS Controls v8 to prioritize our own controls.
• Security questionnaires. If your lender, insurer, or auditor needs details, contact us and we will answer in writing.

Your role in security

• Use a passkey, or a strong, unique password. Do not reuse your involy password on other sites. Use a password manager.
• Store your recovery codes safely. They are the way back in if you lose your authenticator. Keep them out of your email.
• Keep your email account secure. Your email receives password-reset links. If your email is compromised, your involy account is at risk.
• Watch for phishing. involy will never ask for your password or a two-factor code by email or phone.
• Report anomalies. If you notice anything unusual — unexpected sign-ins, missing invoices, or unfamiliar activity — contact us immediately.

Responsible disclosure

We welcome reports from security researchers and users. If you believe you have found a security issue in involy:

• Email info@thinkopen.net with "involy security report" in the subject, a description of the issue, steps to reproduce, and your contact information.
• Please do not exploit the vulnerability or access, modify, or delete data you are not authorized to access.
• Please do not publicly disclose the vulnerability before we have had a reasonable opportunity (typically 90 days) to investigate and remediate.

We will acknowledge your report within two business days, keep you informed of our investigation, and credit you in any public disclosure (unless you prefer to remain anonymous). We do not currently offer a paid bug bounty.

Contact us

Questions about this document or your data? We read every message.

involy / ThinkOpen Inc.
5420 McConnell Ave, Los Angeles, CA 90066
Privacy, legal and security: info@thinkopen.net
Phone: 424.437.8173

This document is provided for transparency and is not legal advice. involy is in early access; we will post material changes here and, where required, notify you directly.