Skip to main content

Data Compliance & Privacy

Data handling policies and compliance features

Data Compliance & Privacy

The platform is designed with data protection principles in mind.

Data Storage

  • Database — MongoDB Atlas with encryption at rest
  • Authentication — Handled by Clerk (SOC 2 compliant)
  • Files — Stored in ImageKit/Cloudinary with access controls
  • Secrets — API keys and passwords stored as environment variables, never in the database

Data Access

Role-based access control ensures users only see data relevant to their role. Financial data is restricted to owners and admins. Personal HR data is visible only to the employee and their manager.

Data Export

Owners can export all platform data (clients, leads, projects, financial records) as structured JSON or CSV. This supports data portability requirements.

Data Deletion

The owner can delete user accounts, which removes their personal data from the platform while preserving anonymized business records for audit purposes.