Security

Encryption

• In transit: every connection to IntegralChase uses HTTPS (TLS), including uploads and downloads.
• At rest: our database and file storage are encrypted at rest by our infrastructure provider.

Private file storage

• Uploaded documents are stored privately. There are no public links to any file.
• Downloads use private links that expire within minutes (60 seconds for a single file, 5 minutes for “Download all”).
• Clients can upload files to their own request, but can't view or download what they uploaded. The only files a client can download are ones your firm has chosen to share with them, from their own private portal link, using the same short-lived download links.
• Deleting a request or a client permanently deletes their uploaded files from storage.

Client upload links

• Each request gets its own secret link with 192 bits of randomness, so it can't be guessed or worked out from another link.
• A link only gives access to that one request's checklist. It never gives access to your account.
• Upload pages are hidden from search engines and don't pass the link on to other websites.
• If a link is shared by mistake, you can create a new one in one click. The old link stops working immediately.

Account separation

Each firm's data is separated by access rules enforced inside the database itself (row-level security), not only by our application code. These rules are designed so that one firm can't read another firm's clients, requests or files.

Uploads

• Only PDFs, photos and spreadsheets are accepted, up to 50 MB per file.
• Automatic checks (wrong month, wrong account, password-locked or damaged files, blurry photos) run on our own servers. Documents are not sent to any AI service.

Sign-in and access

• Passwords are stored as secure hashes by our authentication provider; we never see them.
• You can sign in with Google instead of a password.
• Service keys are kept on our servers only and are never sent to your browser.

Infrastructure

IntegralChase runs on Supabase (database, authentication and file storage) and Vercel (application hosting). Emails are sent through Resend. Each provider runs its own security program; see their security pages for details.

IntegralChase is an early-stage product and has not yet completed its own independent security audit (such as SOC 2). We'd rather tell you that plainly.

If something goes wrong

If a security breach affects your data, we investigate and contain it, tell the affected firms without undue delay and within 72 hours of confirming it, explain what happened, what was involved and what we are doing, and notify authorities where the law requires.

Reporting a problem

If you think you've found a security issue, please email support@integralchase.tech. We'll respond quickly and keep you updated.