Security at RevFound
You're handing us operational and financial records. Here is exactly how they're handled — stated plainly, without claims we haven't earned.
Data isolation
Each company's data is separated using organization-level permissions enforced in the database itself, not just in the interface. Every query is scoped to your organization on the server.
Secure authentication
Accounts are protected by managed authentication with email/password or Google sign-in. Sessions are validated server-side on every request that touches your data.
Encryption
Traffic to RevFound is encrypted in transit (HTTPS), and stored data is encrypted at rest by our hosting infrastructure.
Private document storage
Uploaded files are stored in a private bucket. They are never publicly accessible and are only served through short-lived links generated after your organization membership is verified.
Read-only philosophy
RevFound analyzes your business records. It does not modify your accounting or job management systems, and will not do so without explicit future authorization.
Deletion and access control
Organization owners can export their data at any time and request deletion of their organization. Roles control who can invite users, change billing configuration, and act on findings.
Human-reviewed financial findings
No amount is treated as revenue because software said so. Every opportunity carries the source records, the confirmed pricing rule, and the calculation used. A person at your business verifies a finding before it counts as Verified revenue, and again before it counts as Recovered.
What we don't claim
RevFound is an early-stage product. We are not currently SOC 2 certified, HIPAA compliant, PCI compliant, or ISO certified, and we will not say otherwise. If a formal compliance program is a requirement for your business, tell us and we'll be straight with you about where we are.
Security questions or a vulnerability to report? Email security@revfound.co.