Trust and security

This page is written for the security or procurement reviewer evaluating LandedFees. It covers what we store, where it lives, who processes it, how we authenticate requests, how you can report a problem, and how you can export or delete your data. Everything below is authoritative. If we make a change, the "Last updated" date at the top moves.

Data handling

• Storage. Customer data lives in a managed Postgres database (Supabase) in the EU region (Frankfurt, eu-central-1). Uploaded invoices are stored in the same Supabase project's object storage bucket, also EU region.
• Encryption at rest. Supabase Postgres and Storage encrypt at rest with AES-256. Secrets (SSO client secrets, API-key hashes) are additionally column-level encrypted before insert.
• Encryption in transit. All connections between clients, edge, and origin are TLS 1.2 or newer. HSTS is enabled with a one-year max-age on the primary domain.
• Backups. Point-in-time recovery is retained on the Supabase primary database. Object storage is versioned; deletes are soft for 30 days.
• Logs. Application and edge request logs are retained for 30 days for abuse prevention, debugging, and audit reconstruction, then purged.

Authentication and API access

• User auth. Email OTP by default. Optional SSO via SAML 2.0 or OIDC for org-scoped sign-in, managed at /dashboard/settings/sso.
• API auth. Bearer tokens on every request. Keys are shown once at creation, stored as an scrypt hash on our side, and can be rotated or revoked at any time from /dashboard/api-keys.
• Rate limits. 60 requests per minute per key by default, with the standard X-RateLimit-Limit/X-RateLimit-Remaining/X-RateLimit-Reset response headers. Higher limits available by request.
• RBAC. Four roles per organization: owner, admin, member, viewer. Every write endpoint is role-gated server-side, and role escalation on team invite is blocked (see LFQG-103). Full role matrix in the developer docs.
• Session cookies. One first-party session cookie (lc_session). HttpOnly, Secure, SameSite=Lax.

Sub-processors

The following third parties process customer data on our behalf. The erasure column indicates how we complete a right-to-erasure (GDPR Article 17) request against that processor. "API erasure" means we call a dedicated delete endpoint (durable queue in migration 113). "Cascade delete" means data is removed via the primary database delete. "Manual filing" means we submit a documented request to the processor because they have no self-serve deletion API.

When the sub-processor list changes we publish the change here and, for logged-in users, notify the address on the account. Consent-gated processors (PostHog, GA4, Meta, LinkedIn) only receive data when the user has opted in via the cookie banner, and are torn down synchronously on revocation (LFQG-111 vendor artifact cleanup).

Vulnerability disclosure

If you believe you have found a security issue in LandedFees, please email info@growyourbrand.io with reproduction steps, affected URL, and impact. Please do not test against other customers' data.

• Acknowledgement within one business day.
• Triaged with a severity classification within three business days.
• Critical fixes shipped within seven days of validated report. Lower severities on the standard release train.
• Coordinated disclosure. We will credit the reporter publicly on request once a fix is deployed.

Certifications and audits

LandedFees is a pre-funding independent product. We are not SOC 2 audited, and we do not hold ISO 27001, HIPAA, or FedRAMP attestations. We do not plan to pursue these attestations until the product reaches revenue or funding milestones that justify the annual audit spend (a SOC 2 Type II typically runs $30k to $100k per year plus engineering overhead, which would be indefensible at our current scale).

What we can offer today:

• A written security questionnaire response and architecture diagram on request.
• A signed Data Processing Addendum (DPA) covering GDPR Article 28 obligations.
• Sub-processor list above, updated within seven days of any addition or removal.
• A public status page at /status covering the same dependency surface.

Data export and deletion

Every account holder has an unconditional right to export or delete their data, independent of jurisdiction. The self- serve endpoints:

• Export. Request a full account bundle (calculations, uploaded invoices, audit history, billing record) from the Data export panel on /dashboard/account. Bundles are prepared as a zipped JSON plus original files and delivered by email within one business day.
• Delete. Close and purge the account from the Delete account panel on /dashboard/account. Local rows are marked for hard deletion after a 30-day grace window; the same purge writes one row per sub-processor into the durable erasure queue (migration 113) so external state is torn down within days rather than being best-effort.
• Correction and portability. For anything not covered above, email the disclosure address and we will respond inside the applicable statutory window (typically 30 days).

Contact

All security, privacy, procurement, and disclosure correspondence goes to info@growyourbrand.io. Signed by the LandedFees team.