Tare7
Get started

Security

How your data is protected.

A plain-language look at how Tare7 protects your business data, what controls exist today, what is still missing, and who to contact if you find a problem.

A business owner reviewing important records with a trusted advisor

Tenant isolation

Every row in the database is tagged with your org_id. Postgres row-level security policies enforce that every SELECT, INSERT, UPDATE, and DELETE is scoped to the caller's current org — even if the application layer is bypassed. Multi-tenant tables in the current schema all have this policy set; new tables get a static test that fails CI if RLS is missing.

Encryption in transit + at rest

HTTPS on every request; automatic TLS via Vercel's edge. Data at rest in Postgres is encrypted by Supabase using AES-256. File uploads (logos, item photos, order attachments) live in private storage buckets scoped by org_id folder — accessed via short-lived signed URLs, never public.

Passwords + authentication

Passwords are hashed by Supabase Auth (bcrypt) — Tare7 never sees them. Minimum 12 characters at signup and on reset. The password-reset link is a single-use token that expires; session cookies are HTTP-only and secure.

Backups + retention

Tare7 uses the backup controls available on its active Supabase plan. Backup retention and point-in-time recovery depend on the provider configuration and are not a contractual recovery SLA. Canceling a subscription does not delete a workspace. An authorized deletion request starts a 30-day recovery window before live data is purged; backup copies then age out through normal rotation.

Data portability — your data is yours

Tare7 provides CSV exports for key operational records, including:

  • Items, vendors, customers, locations — from each list's Export button.
  • Sales orders, purchase orders, invoices, shipments — from the reports hub.
  • Inventory ledger (every RECEIVE / RELEASE / TRANSFER / ADJUST) — from Reports.
  • AR aging, customer statement, outstanding invoices — from Customer reports.

Need a full-org dump for migration? Email privacy@tare7.com and we'll explain the available export and data-request options.

Subprocessors

Full list in the Privacy Policy. Short version: Supabase (DB, auth, storage), Vercel (hosting), Stripe and Apple (billing), Resend (transactional email), and OpenAI when Tare is enabled. Current details are maintained in the Privacy Policy.

What we send AI

When an enabled Tare7 Intelligence feature runs, the server sends only the context authorized for that action. That can include the operational records or uploaded document needed to answer the request. Responses are labeled as AI-generated and should be reviewed before use.

Two features send more by their nature, and only when you invoke them: packing-slip extraction sends the packing slip you upload, and plain-language search sends the words you typed plus the server-authorized context needed to answer. AI employees remain disabled unless individually reviewed and enabled. Mutating proposals require the product's authorization and confirmation controls; an AI response alone does not approve or post a business transaction.

Access controls

Every user has a role (owner / admin / manager / staff / field) enforced at both the RLS layer and the app-action layer.

Stock movement carries its own trail: every row in the inventory ledger records the acting user and timestamp, and the ledger is append-only — there is no policy permitting an UPDATE or DELETE, so history cannot be rewritten from the application. Adjustments additionally require a reason code.

A separate audit log records platform-admin impersonation and account-deletion events. Impersonation for support is possible but recorded — the impersonated user id and the impersonator id both land in that log.

What we DON'T have yet

An honest list of gaps you'd expect and we don't currently offer:

  • SOC 2 Type II attestation — targeting late 2026.
  • ISO 27001 — targeting 2027.
  • Single sign-on — no SAML or OIDC; email and password only.
  • Public API write endpoints — read-only today; write coming with the API on Scale.
  • Audit-log coverage of every mutation — today it records impersonation and account deletion; the inventory ledger is the trail for stock movement.
  • Accounting-package sync — there is no QuickBooks or Xero integration. The balanced double-entry CSV export is the supported path today.
  • Public status page — coming; email is the interim channel.
  • HIPAA — we are not a HIPAA-covered service.

If a compliance certificate is a hard requirement for your org, we're not the right fit today. Talk to us anyway if you want to be notified when we get there.

Report a vulnerability

Please email security@tare7.com. Security reports are prioritized by severity. Responsible disclosure is appreciated — please don't publish before we've had a chance to patch.